Weblate wlc has insecure API key configuration

TRUNG BÌNH 5.5CVE-2026-22251 · GHSA-9rp8-h4g8-8766 · PYSEC-2026-2052 · Công bố 12/01/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-22251 là lỗ hổng mức TRUNG BÌNH (CVSS 5.5) ảnh hưởng wlc, wlc (weblate).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.19%, cao hơn 8.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.17.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
wlc PyPI	`< 1.17.0`	`1.17.0`
wlc weblate	`< 1.17.0`	`1.17.0`

Mô tả

Impact

Historically, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be used against different server.

Patches

https://github.com/WeblateOrg/wlc/pull/1098

Workarounds

Remove unscoped key from wlc configuration. Only use URL-scoped keys in the [keys] sections.

References

This issue was reported to us by wh1zee via HackerOne.

Mô tả của NVD

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.