Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.

Stable Diffusion WebUI through version 1.10.1 is affected by a credential disclosure vulnerability in the /sdapi/v1/cmd-flags API endpoint. This endpoint returns parsed command-line arguments, including gradio_auth and api_auth values, in cleartext without requiring authentication. Unauthenticated attackers can query this endpoint to retrieve configured usernames and passwords. The disclosed credentials can then be used to authenticate to the WebUI interface and gain full access to the application. The vulnerability poses a significant risk to any deployment where authentication credentials have been configured via command-line arguments. No authentication or special privileges are required to exploit this issue. The vulnerability is tracked as CVE-2026-82288 and affects the AUTOMATIC1111 Stable Diffusion WebUI project. Users are advised to review their deployments and apply mitigations or patches as they become available.