Which versions of Stable Diffusion WebUI are affected by CVE-2026-82288?

AUTOMATIC1111 Stable Diffusion WebUI versions through 1.10.1 expose all configured authentication credentials to any attacker with network access-even those without authorization.

How to fix or mitigate CVE-2026-82288?

Within 24 hours: Immediately audit your environment for AUTOMATIC1111 WebUI instances; determine which are exposed to untrusted networks (especially the internet); if publicly reachable, take offline or disable network access pending mitigation. Rotate all gradio_auth and api_auth credentials across all affected instances regardless of network exposure. Within 7 days: Review access logs for the `/sdapi/v1/cmd-flags` endpoint to identify potential exploitation attempts; audit authentication logs for unauthorized access using the exposed credentials; confirm no lateral movement to other systems. Within 30 days: Monitor AUTOMATIC1111 release channels continuously for a patch addressing CVE-2026-82288; if your organization depends on this tool, evaluate alternative Stable Diffusion interfaces or restrict access to segmented internal networks only with no public internet exposure.

Stable Diffusion WebUI CVE-2026-82288

Q: What is the CVSS score of CVE-2026-82288?

CVE-2026-82288 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-67819 HIGH

Insufficiently Protected Credentials (CWE-522)

2026-08-28 VulnCheck

GHSA-75pm-v38f-v69m

Information Disclosure Stable Diffusion Webui Automatic1111

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network endpoint returns credentials verbatim; no integrity or availability impact results directly from the disclosure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 28, 2026 - 20:40 vuln.today

CVE Published

Aug 28, 2026 - 16:19 cve.org

HIGH 8.7

DescriptionCVE.org

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.

AnalysisAI

Credential disclosure in AUTOMATIC1111 Stable Diffusion WebUI through version 1.10.1 exposes configured authentication credentials to unauthenticated network attackers via the /sdapi/v1/cmd-flags REST endpoint. The endpoint serializes all runtime command-line arguments - including gradio_auth and api_auth values - into a cleartext JSON response with no access control, directly nullifying the authentication protection those flags are meant to provide. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires two concurrent conditions: (1) the Stable Diffusion WebUI instance must be network-accessible from the attacker - meaning it was started with `--listen` or otherwise bound to a non-loopback interface, which is not the default configuration; and (2) authentication must have been configured using the `--gradio-auth` or `--api-auth` startup flags, as these are the specific argument values disclosed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N accurately reflects the exploitation characteristics: network-accessible, zero-complexity, unauthenticated, and no user interaction required - yielding full credential exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis; the input data references a GitHub issue (https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17411) but no tagged release containing a fix. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Immediately audit your environment for AUTOMATIC1111 WebUI instances; determine which are exposed to untrusted networks (especially the internet); if publicly reachable, take offline or disable network access pending mitigation. …

Threat intelligence, references, and detailed analysis are available after sign-in.