Server-Side Request Forgery Vulnerability in Weblate Localization Platform
CVE-2026-77573

3.5LOW

Key Information:

Vendor

Weblateorg

Status
Weblate
Vendor
CVE Published:
26 August 2026

What is CVE-2026-77573?

Weblate, a continuous localization platform, is susceptible to a server-side request forgery vulnerability in versions earlier than 2026.8. This weakness allows a user with privileges to manage component repository URLs to exploit DNS rebinding, potentially compromising internal services. The initial DNS resolution by Weblate is validated; however, the connection made by external VCS clients involves a separate DNS lookup. An attacker could manipulate a hostname to initially resolve a public address and later redirect it to a private address. By initiating operations such as clone, fetch, or push, the attacker might compel Weblate to interact with internal VCS-compatible services, which could result in the exposure of private repository content. This vulnerability impacts installations that allow untrusted repository hostnames with VCS_RESTRICT_PRIVATE set to True and is remedied in version 2026.8.

Affected Version(s)

weblate < 2026.8

References

https://github.com/WeblateOrg/weblate/security/advisories...
x_refsource_CONFIRM
https://github.com/WeblateOrg/weblate/commit/3f31f094eb4f...
x_refsource_MISC

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.