Weblate: SSRF via Project-Level Machinery Configuration

TRUNG BÌNH 5.0CVE-2026-34244 · GHSA-xrwr-fcw6-fmq8 · PYSEC-2026-2314 · Công bố 15/04/2026 · cập nhật 26/10/2026

Tóm tắt nhanh

CVE-2026-34244 là lỗ hổng mức TRUNG BÌNH (CVSS 5.0) ảnh hưởng weblate, weblate (weblate).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.25%, cao hơn 17.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 5.17 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
weblate PyPI	`< 5.17`	`5.17`
weblate weblate	`< 5.17`	`5.17`

Mô tả

Impact

A user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read.

Patches

https://github.com/WeblateOrg/weblate/pull/18684
The solution then has been cleaned up in followup patches

Workarounds

Limiting available machinery services via WEBLATE_MACHINERY setting can avoid this.

References

Thanks to @DavidCarliez for disclosing this via GitHub private vulnerability reporting.

Mô tả của NVD

Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machinery services via WEBLATE_MACHINERY setting.