Server-Side Request Forgery Vulnerability in Weblate Localization Tool

CVE-2026-34244

What is CVE-2026-34244?

Weblate, an online localization tool, contains a vulnerability that allows a user with project.edit permissions to set machine translation service URLs to arbitrary internal addresses. During the validation of these configurations, an HTTP request is made to the specified URL, which can lead to the disclosure of sensitive information through the response body. The vulnerability reflects up to 200 characters of the response back to the user, creating a potential attack vector. This issue has been addressed in version 5.17, and users are encouraged to upgrade their installations to mitigate risks. For those unable to upgrade immediately, it is possible to limit accessible machinery services through the WEBLATE_MACHINERY setting.

References