CVE-2026-22251: wlc may leak API keys due to an insecure API key configuration
Impact Historically, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be used against different server.
Patches https://github.com/WeblateOrg/wlc/pull/1098
Workarounds Remove unscoped key from wlc configuration. Only use URL-scoped keys in the [keys] sections.
References This issue was reported to us by wh1zee via HackerOne.
Other sources
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22251?
CVE-2026-22251 is considered a high-severity vulnerability due to the potential for API key leakage.
How do I fix CVE-2026-22251?
To fix CVE-2026-22251, upgrade to wlc version 1.17.0 or later.
What type of issue is CVE-2026-22251?
CVE-2026-22251 is an issue related to insecure API key configuration in the wlc software.
What could happen if CVE-2026-22251 is exploited?
If exploited, CVE-2026-22251 may allow unauthorized use of API keys against different servers.
Which versions of wlc are affected by CVE-2026-22251?
Versions of wlc prior to 1.17.0 are affected by CVE-2026-22251.