Read the docs
TI-2026-26539 Aliases CVE-2026-34244GHSA-xrwr-fcw6-fmq8

Weblate: SSRF via Project-Level Machinery Configuration

Priority LOW 22CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machinery services via WEBLATE_MACHINERY setting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00254 17th percentileScored 2026-11-07
Fix Fixed weblate (WeblateOrg): 517weblate (PyPI): 5.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WeblateOrgweblatebefore 517517Patch availableCNA
—weblate (PyPI)before 5.175.17Patch availableGHSA-xrwr-fcw6-fmq8
  • weblate VendorWeblateOrg Affected before 517 Fixed in 517 Patch available CNA
  • weblate (PyPI) Vendor— Affected before 5.17 Fixed in 5.17 Patch available GHSA-xrwr-fcw6-fmq8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*before 5.17VulnerableWeblateOrg
  • cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:* Versions before 5.17 Vulnerable ·WeblateOrg

Remediation

  • Fix · CNA weblate (WeblateOrg) Fixed in 517
  • Fix · GHSA-xrwr-fcw6-fmq8 weblate (PyPI) Fixed in 5.17 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34244
  2. 2026-10-03 Alias added: GHSA-xrwr-fcw6-fmq8

References

Patch 1

Advisory 2

Other 2

  • TI-2025-23145 Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext CVSS 3.1HIGH 7.5
  • TI-2025-38033 Weblate integration with Anubis can lead to Open Redirect via redir parameter CVSS 4.0LOW 2.1
  • TI-2022-07893 Remote code execution (RCE) in Weblate CVSS 3.1HIGH 8.8
  • TI-2025-41967 Weblate has git config file overwrite vulnerability that leads to remote code execution CVSS 3.1CRITICAL 9.1
  • TI-2026-26679 Weblate: Privilege escalation in the user API endpoint CVSS 3.1HIGH 8.8
  • TI-2026-19444 Weblate has an argument injection in management console CVSS 3.1CRITICAL 9.1
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences