CVE-2026-22250: wlc can skip SSL verification
Impact The SSL verification would be skipped for some crafted URLs.
Patches https://github.com/WeblateOrg/wlc/pull/1097
Workarounds Avoid using untrusted wlc configurations, as that might cause insecure connections.
References This issue was reported to us by wh1zee via HackerOne.
Other sources
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22250?
CVE-2026-22250 is classified as a high-severity vulnerability due to its potential to allow insecure connections by skipping SSL verification.
How do I fix CVE-2026-22250?
To fix CVE-2026-22250, ensure that you update to wlc version 1.17.0 or later after the patch is applied.
What are the potential impacts of CVE-2026-22250?
The potential impacts of CVE-2026-22250 include the risk of man-in-the-middle attacks due to unverified SSL connections.
What should I do if I can't update to a patched version for CVE-2026-22250?
If you cannot update, avoid using untrusted wlc configurations to mitigate the risks posed by CVE-2026-22250.
Can CVE-2026-22250 be exploited easily?
Yes, CVE-2026-22250 can be exploited easily if an attacker is able to direct users to crafted URLs that bypass SSL verification.