# CVE-2026-82288: Stable Diffusion WebUI credential disclosure in /sdapi/v1/cmd-flags endpoint

Source: https://junglewise.ai/threats/cve-2026-82288-stable-diffusion-webui-credential-disclosure-in-sdapi-v1-cmd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82288 · Severity: high · CVSS 7.5 · Published 2026-08-28

Stable Diffusion WebUI, a popular open-source interface for AI image generation, exposes configured usernames and passwords through an unauthenticated API endpoint. An attacker can retrieve these credentials without authentication and use them to gain full access to the application, allowing them to run unauthorized image generation jobs or modify system settings.

Technologies: [AUTOMATIC1111 Stable Diffusion WebUI](https://junglewise.ai/threats/technologies/stable-diffusion-webui). Vendors: [AUTOMATIC1111](https://junglewise.ai/threats/vendors/automatic1111).

## Quick answers

**Is CVE-2026-82288 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82288 being exploited in the wild.

**How severe is CVE-2026-82288?** High severity, with a CVSS score of 7.5, published 28 August 2026.

**Which products and versions are affected?** AUTOMATIC1111 Stable Diffusion WebUI through 1.10.1.

**Is there a fix for CVE-2026-82288?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82288 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82288?** Check whether you run AUTOMATIC1111 Stable Diffusion WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The /sdapi/v1/cmd-flags endpoint in Stable Diffusion WebUI through version 1.10.1 returns parsed command-line arguments including gradio_auth and api_auth credentials in cleartext without requiring authentication. The vulnerability exists in the API's credential handling logic and allows any network-accessible attacker to retrieve configured usernames and passwords by making an HTTP GET request to the endpoint. Once obtained, these credentials can be used to authenticate to the web interface or API, granting the attacker full application access. This is a direct information disclosure vulnerability with no special preconditions beyond network reachability.

## Affected products

- AUTOMATIC1111 Stable Diffusion WebUI through 1.10.1

## Timeline

- 2026-08-28: disclosed

## References

- [https://github.com/AUTOMATIC1111/stable-diffusion-webui](https://github.com/AUTOMATIC1111/stable-diffusion-webui)
- [https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/82a973c04367123ae98bd9abdf80d9eda9b910e2/modules/api/api.py](https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/82a973c04367123ae98bd9abdf80d9eda9b910e2/modules/api/api.py)

## Related threats

- [AUTOMATIC1111 stable-diffusion-webui stored XSS in Extra-Networks Card Builder](https://junglewise.ai/threats/cve-2026-111987-a-vulnerability-was-identified-in-automatic1111-stable-diffusion)
- [AUTOMATIC1111 stable-diffusion-webui code injection in model instantiation](https://junglewise.ai/threats/cve-2026-111986-a-vulnerability-was-determined-in-automatic1111-stable-diffusion)
- [AUTOMATIC1111 stable-diffusion-webui resource exhaustion in metadata extraction](https://junglewise.ai/threats/cve-2026-111985-a-vulnerability-was-found-in-automatic1111-stable-diffusion)
- [AUTOMATIC1111 stable-diffusion-webui cross-site scripting in card builder](https://junglewise.ai/threats/cve-2026-111984-a-vulnerability-has-been-found-in-automatic1111-stable-diffusion)