CVE-2026-82288

Name of the Vulnerable Software and Affected Versions Stable Diffusion WebUI versions prior to 1.10.2

Description An issue exists where the '/sdapi/v1/cmd-flags' endpoint returns parsed command-line arguments in cleartext. This allows unauthenticated attackers to retrieve sensitive credentials, specifically the gradio auth and api auth variables, which can then be used to authenticate to the interface and gain unauthorized access to the application.

Recommendations Update Stable Diffusion WebUI to version 1.10.2 or later. As a temporary mitigation, restrict access to the '/sdapi/v1/cmd-flags' endpoint.