CVE-2026-34244 WeblateOrg CVE debrief

Who should care

Defenders responsible for Weblate deployments, particularly those with users who have project.edit permission, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-34244 is a medium-severity SSRF vulnerability in Weblate that allows attackers to make HTTP requests to arbitrary internal network addresses and read partial responses. Defenders should prioritize verifying exposure, assessing impact, and remediating vulnerable Weblate deployments.

• Potential SSRF attacks on internal network addresses
• Partial response read from attacker-controlled URLs
• Verification of Weblate version and exposure required
• Remediation priority for Weblate deployments

Technical summary

The vulnerability allows a user with project.edit permission to configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machinery services via WEBLATE_MACHINERY setting. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, particularly those with Weblate deployments.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, particularly those with Weblate deployments. Immediate action is required to prevent potential SSRF attacks.

Recommended defensive actions

• Verify Weblate version and assess exposure
• Limit available machinery services via WEBLATE_MACHINERY setting if immediate upgrade is not possible
• Monitor for potential SSRF attacks
• Upgrade to Weblate version 5.17 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected versions. The Weblate project has fixed the issue in version 5.17. Weblate is a web-based localization tool that allows users with project.edit permission to configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.