PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33440 WeblateOrg CVE debrief

CVE-2026-33440 is a medium-severity vulnerability in Weblate, a web-based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting did not restrict possible redirects, potentially allowing attackers to access unauthorized resources. This issue was fixed in version 5.17. Weblate administrators and users should assess exposure and prioritize updating to version 5.17 or later to mitigate this vulnerability. The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions.

Vendor
WeblateOrg
Product
weblate
CVSS
MEDIUM 5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-15
Original CVE updated
2026-10-26
Advisory published
2026-04-15
Advisory updated
2026-10-26

Who should care

Weblate administrators and users should assess exposure and prioritize updating to version 5.17 or later to mitigate this vulnerability. The vulnerability allows attackers to access unauthorized resources due to inadequate redirect restrictions. Defenders should prioritize verifying Weblate versions and updating to 5.17 or later to mitigate this vulnerability.

Why it matters

CVE-2026-33440 is a medium-severity vulnerability in Weblate that allows attackers to access unauthorized resources due to inadequate redirect restrictions. Defenders should prioritize verifying Weblate versions and updating to 5.17 or later to mitigate this vulnerability.

  • Verify Weblate version to determine exposure
  • Restrict redirects using ALLOWED_ASSET_DOMAINS setting
  • Monitor Weblate instance for suspicious activity

Technical summary

The ALLOWED_ASSET_DOMAINS setting in Weblate versions prior to 5.17 did not restrict possible redirects, potentially allowing attackers to access unauthorized resources. This issue was fixed in version 5.17. Weblate administrators and users should assess exposure and prioritize updating to version 5.17 or later to mitigate this vulnerability. The vulnerability allows attackers to access unauthorized resources due to inadequate redirect restrictions.

Defensive priority

Defenders should prioritize verifying Weblate versions and updating to 5.17 or later to mitigate this vulnerability.

Recommended defensive actions

  • Verify Weblate version and update to 5.17 or later
  • Review ALLOWED_ASSET_DOMAINS setting and restrict redirects as needed
  • Monitor Weblate instance for suspicious activity

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The ALLOWED_ASSET_DOMAINS setting in Weblate versions prior to 5.17 did not restrict possible redirects, potentially allowing attackers to access unauthorized resources. Weblate administrators and users should assess exposure and prioritize updating to version 5.17 or later to mitigate this vulnerability. The vulnerability allows attackers to access Weblate

Sources and references

Verified primary and authoritative sources

  • CVE-2026-33440 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-33440

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-33440 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33440

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.