CVE-2026-34244 json
Weblate: SSRF via Project-Level Machinery Configuration
published 2026-04-15 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-23004 , GHSA-xrwr-fcw6-fmq8 , PYSEC-2026-2314
- cvss
- 5.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 17%
- public exploits
- 0
- none known
Summary
Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machinery services via WEBLATE_MACHINERY setting.
Patch / fix
- pypi weblate 5.17
- weblate weblate 5.17
- github.com/WeblateOrg/weblate@e619e90 commit
- github.com/WeblateOrg/weblate#18684 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
| GitHub | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
| OSV | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | weblate | <5.17 |
5.17 |
Affected products
- WeblateOrg weblate
Classification
References
-
github.com
/WeblateOrg/weblate/commit/e619e9090202e4886b844c110d39308e7e882c0e
web, patch
-
github.com
/WeblateOrg/weblate/pull/18684
web
-
github.com
/WeblateOrg/weblate/security/advisories/GHSA-xrwr-fcw6-fmq8
web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-34244
advisory
-
github.com
/WeblateOrg/weblate
package
Sources
- CVE List CVE-2026-34244
- GitHub Advisory GHSA-xrwr-fcw6-fmq8
- NVD CVE-2026-34244
- OSV PYSEC-2026-2314
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.