CVE-2026-82288: Stable Diffusion WebUI Credential Disclosure

CVE-2026-82288 Overview

CVE-2026-82288 is a credential disclosure vulnerability in Stable Diffusion WebUI through version 1.10.1. The application exposes an unauthenticated /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments in cleartext. These arguments include the gradio_auth and api_auth values used to protect the interface and API.

Unauthenticated network attackers can query this endpoint, extract configured usernames and passwords, and reuse them to log in. The vulnerability is classified as insufficiently protected credentials [CWE-522].

Critical Impact
Remote attackers can retrieve authentication credentials from an unauthenticated API endpoint and gain full access to the Stable Diffusion WebUI interface and its API.

Affected Products

AUTOMATIC1111 Stable Diffusion WebUI versions up to and including 1.10.1
Deployments using --gradio-auth for interface authentication
Deployments using --api-auth for API authentication

Discovery Timeline

2026-08-28 - CVE-2026-82288 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82288

Vulnerability Analysis

Stable Diffusion WebUI is a Gradio-based interface for running Stable Diffusion image generation models. Operators launch the application with command-line flags that configure runtime behavior. Two of these flags, --gradio-auth and --api-auth, accept username:password pairs used to gate access to the web interface and REST API.

The API module in modules/api/api.py registers a /sdapi/v1/cmd-flags route that returns the parsed argument namespace as a JSON response. This route does not enforce authentication and does not filter sensitive fields before serialization. Any client with network access to the WebUI can request the endpoint and receive the full argument set.

Because the endpoint returns credentials in cleartext, an attacker who reads the response learns valid login material for the same deployment. The attacker then authenticates through the standard Gradio login or the API and controls image generation, model loading, and any local functionality the WebUI exposes.

Root Cause

The root cause is a missing access control on an endpoint that discloses sensitive configuration state. The API handler serializes the entire parsed argparse namespace instead of applying an allowlist that excludes credential-bearing fields such as gradio_auth, gradio_auth_path, api_auth, and api_auth_path. See GitHub Issue #17411 and the VulnCheck Advisory on Credential Disclosure for reference.

Attack Vector

Exploitation requires only network reachability to the WebUI. An attacker sends an HTTP GET request to /sdapi/v1/cmd-flags on the target host and port, parses the JSON response, and extracts the gradio_auth or api_auth value. The attacker then supplies those credentials to the login form or as an HTTP Basic Authorization header to authenticate.

// Example request flow (described in prose, no exploit code)
// 1. GET http://target:7860/sdapi/v1/cmd-flags
// 2. Read gradio_auth field from JSON response (format: "user:pass")
// 3. Authenticate to / or /sdapi/v1/* using the disclosed credentials

See the GitHub API Source Code for the endpoint implementation.

Detection Methods for CVE-2026-82288

Indicators of Compromise

HTTP requests to /sdapi/v1/cmd-flags from external or unexpected source addresses
Successful authentications to the WebUI shortly after a request to the cmd-flags endpoint from the same source
Access log entries showing the cmd-flags path returning HTTP 200 without a preceding authenticated session
Unexpected model loads, image generation jobs, or API calls following credential retrieval

Detection Strategies

Alert on any HTTP GET to /sdapi/v1/cmd-flags originating from outside a trusted management network
Correlate cmd-flags requests with subsequent authenticated sessions from the same client address
Inspect reverse proxy or WAF logs for the cmd-flags path and flag it as sensitive
Baseline expected API consumers and alert on new user agents or IPs interacting with /sdapi/v1/*

Monitoring Recommendations

Forward WebUI and reverse proxy access logs to a central logging platform for retention and search
Monitor for scanning patterns targeting known Stable Diffusion WebUI paths on TCP 7860 and adjacent ports
Track process command-line arguments on hosts running the WebUI to identify deployments using --gradio-auth or --api-auth

How to Mitigate CVE-2026-82288

Immediate Actions Required

Restrict network access to the Stable Diffusion WebUI to trusted management networks or a VPN
Rotate any gradio_auth and api_auth credentials that were configured on exposed instances
Block external access to /sdapi/v1/cmd-flags at a reverse proxy or WAF until a patched build is deployed
Audit access logs for prior requests to /sdapi/v1/cmd-flags and treat matches as potential credential exposure

Patch Information

No fixed version is listed in the NVD entry for versions through 1.10.1. Monitor the AUTOMATIC1111 Stable Diffusion WebUI repository and GitHub Issue #17411 for an official fix, and consult the VulnCheck Advisory on Credential Disclosure for the latest remediation guidance.

Workarounds

Place the WebUI behind a reverse proxy that enforces authentication before requests reach the application
Deny /sdapi/v1/cmd-flags at the reverse proxy layer using a location or path-match rule
Bind the WebUI to localhost and expose it only through an authenticated tunnel
Avoid passing credentials on the command line; where possible use file-based authentication paths that are not returned by the endpoint

bash

# Example nginx configuration to block the vulnerable endpoint
location = /sdapi/v1/cmd-flags {
    deny all;
    return 403;
}

location / {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://127.0.0.1:7860;
}