VULNERABILITY INTELLIGENCE
CVE-2026-82288
CVSS score7.5 HIGH
EPSS probability0.41%
CISA KEVNot currently listed
Published2026-08-28
Last modified2026-09-24
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.
Weakness classification
- disclosure@vulncheck.com: CWE-522