Weblate: SSRF via Project-Level Machinery Configuration

中 5.0CVE-2026-34244 · GHSA-xrwr-fcw6-fmq8 · PYSEC-2026-2314 · 15/04/2026 公開 · 26/10/2026 更新

要点

CVE-2026-34244 は weblate, weblate (weblate) に影響する深刻度「中」 (CVSS 5.0) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.25%（全脆弱性の 17.0% より高い）。
対処：5.17 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
weblate PyPI	`< 5.17`	`5.17`
weblate weblate	`< 5.17`	`5.17`

概要

Impact

A user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read.

Patches

https://github.com/WeblateOrg/weblate/pull/18684
The solution then has been cleaned up in followup patches

Workarounds

Limiting available machinery services via WEBLATE_MACHINERY setting can avoid this.

References

Thanks to @DavidCarliez for disclosing this via GitHub private vulnerability reporting.

NVD の説明

Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machinery services via WEBLATE_MACHINERY setting.