In breve
- CVE-2026-22251 è una vulnerabilità MEDIO (CVSS 5.5) che riguarda wlc, wlc (weblate).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.19%, superiore al 8.5% delle vulnerabilità.
- Correzione: aggiornare a 1.17.0 o successiva.
| Package | Affected versions | Patched versions |
|---|
| wlc PyPI | < 1.17.0
| 1.17.0
|
| wlc | < 1.17.0
| 1.17.0
|
Description
Impact
Historically, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be used against different server.
Patches
Workarounds
Remove unscoped key from wlc configuration. Only use URL-scoped keys in the [keys] sections.
References
This issue was reported to us by wh1zee via HackerOne.
NVD description
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free