CVE-2026-82288: cmd-flags endpoint leaks creds

CISO Take

Stable Diffusion WebUI's /sdapi/v1/cmd-flags endpoint echoes back the full parsed command-line arguments — including the gradio_auth and api_auth values administrators set specifically to lock the interface down — to any unauthenticated caller. That means the one control operators rely on to keep a self-hosted image-generation service private can be defeated with a single GET request, no scanning tools or exploit chain required; this isn't in CISA KEV and no public exploit or Nuclei template exists yet, but the barrier to abuse is effectively zero since it's a documented, un-authenticated API call. Any AI/ML team running SD WebUI as a shared internal tool or exposing it to a network for automation should treat this as a full authentication-bypass path, not a low-severity info leak. Restrict network access to the API immediately (firewall/reverse-proxy with independent auth) and rotate any gradio_auth/api_auth credentials that may have been exposed, then move to a patched release once AUTOMATIC1111 ships one — track https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17411 for status.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

CVSS 3.1 base score 7.5 (high) driven entirely by confidentiality impact (C:H) with no integrity or availability impact from the disclosure itself — but that framing understates real risk, since the confidential data disclosed IS the authentication secret, making follow-on impact equivalent to a full auth bypass. Attack vector is network, complexity low, no privileges or user interaction required, so any internet- or LAN-exposed instance is trivially reachable. No EPSS data, no CISA KEV listing, and no public exploit code or Nuclei template are currently available, which caps near-term mass-exploitation likelihood, but the trivial one-request exploitation method means opportunistic scanning could pick this up quickly once awareness spreads.

How does the attack unfold?

Recon

Attacker identifies an internet- or network-exposed Stable Diffusion WebUI instance via scanning or fingerprinting.

AML.T0006

Credential harvesting

Attacker sends an unauthenticated GET request to /sdapi/v1/cmd-flags and extracts the cleartext gradio_auth/api_auth values from the JSON response.

AML.T0055

Authentication

Attacker uses the harvested credentials to log into the web UI or authenticate to the API as a valid user.

AML.T0012

Impact

Attacker gains full operator access to the AI service — generating content, exfiltrating models/artifacts, or pivoting to other known extension vulnerabilities.

AML.T0047

Recon

Attacker identifies an internet- or network-exposed Stable Diffusion WebUI instance via scanning or fingerprinting.

AML.T0006

Credential harvesting

Attacker sends an unauthenticated GET request to /sdapi/v1/cmd-flags and extracts the cleartext gradio_auth/api_auth values from the JSON response.

AML.T0055

Authentication

Attacker uses the harvested credentials to log into the web UI or authenticate to the API as a valid user.

AML.T0012

Impact

Attacker gains full operator access to the AI service — generating content, exfiltrating models/artifacts, or pivoting to other known extension vulnerabilities.

AML.T0047

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Do not rely solely on gradio_auth/api_auth as a perimeter control — place the SD WebUI instance behind a reverse proxy or VPN with independent authentication, and firewall the /sdapi/* endpoints from untrusted networks. 2) Rotate gradio_auth and api_auth credentials on any instance that has ever been reachable from an untrusted network, since they must be assumed compromised. 3) Upgrade to a patched release as soon as AUTOMATIC1111 ships a fix beyond 1.10.1 (monitor the linked GitHub issue #17411). 4) Detection: alert on unauthenticated GET requests to /sdapi/v1/cmd-flags in access logs, and audit for unexpected logins or API usage on SD WebUI instances following any period of internet exposure.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassAPIInferenceAML.T0006- Active Scanning AML.T0012- Valid Accounts AML.T0047- AI-Enabled Product or Service AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE 4.1-AI system risks and benefits are regularly monitored based on assessed risks

OWASP LLM Top 10

LLM06-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-82288?

Stable Diffusion WebUI's /sdapi/v1/cmd-flags endpoint echoes back the full parsed command-line arguments — including the gradio_auth and api_auth values administrators set specifically to lock the interface down — to any unauthenticated caller. That means the one control operators rely on to keep a self-hosted image-generation service private can be defeated with a single GET request, no scanning tools or exploit chain required; this isn't in CISA KEV and no public exploit or Nuclei template exists yet, but the barrier to abuse is effectively zero since it's a documented, un-authenticated API call. Any AI/ML team running SD WebUI as a shared internal tool or exposing it to a network for automation should treat this as a full authentication-bypass path, not a low-severity info leak. Restrict network access to the API immediately (firewall/reverse-proxy with independent auth) and rotate any gradio_auth/api_auth credentials that may have been exposed, then move to a patched release once AUTOMATIC1111 ships one — track https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17411 for status.

Is CVE-2026-82288 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-82288, increasing the risk of exploitation.

How to fix CVE-2026-82288?

1) Do not rely solely on gradio_auth/api_auth as a perimeter control — place the SD WebUI instance behind a reverse proxy or VPN with independent authentication, and firewall the /sdapi/* endpoints from untrusted networks. 2) Rotate gradio_auth and api_auth credentials on any instance that has ever been reachable from an untrusted network, since they must be assumed compromised. 3) Upgrade to a patched release as soon as AUTOMATIC1111 ships a fix beyond 1.10.1 (monitor the linked GitHub issue #17411). 4) Detection: alert on unauthenticated GET requests to /sdapi/v1/cmd-flags in access logs, and audit for unexpected logins or API usage on SD WebUI instances following any period of internet exposure.

What systems are affected by CVE-2026-82288?

This vulnerability affects the following AI/ML architecture patterns: model serving, inference API access.

What is the CVSS score for CVE-2026-82288?

CVE-2026-82288 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

model servinginference API access

MITRE ATLAS Techniques

AML.T0006Active Scanning

AML.T0012Valid Accounts

AML.T0047AI-Enabled Product or Service

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.

Exploitation Scenario

An attacker scans IP ranges or uses Shodan/Censys to find internet-facing Stable Diffusion WebUI instances (identifiable via default ports/banners), then sends a single unauthenticated GET request to /sdapi/v1/cmd-flags on each candidate. The JSON response includes the full command-line argument set, from which the attacker extracts the gradio_auth username/password and any api_auth token in cleartext. Using those credentials, the attacker logs into the web UI or authenticates to the REST API, gaining full operator access — from there they can pull proprietary custom models/LoRAs off the instance, run generation jobs at the victim's expense, or probe installed extensions for further remote-code-execution vulnerabilities.

Weaknesses (CWE)

CWE-522Insufficiently Protected CredentialsPrimary CWE-522Insufficiently Protected Credentials

CWE-522 — Insufficiently Protected Credentials: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

[Architecture and Design] Use an appropriate security mechanism to protect the credentials.
[Architecture and Design] Make appropriate use of cryptography to protect the credentials.

Source: MITRE CWE corpus.