CVE-2026-24126: Weblate has an argument injection in management console
Impact The SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to ssh-add.
Patches https://github.com/WeblateOrg/weblate/pull/17722
Workarounds Properly limit access to the management console.
References This issue was reported to us by alexb616 via HackerOne.
Other sources
Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to ssh-add. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24126?
CVE-2026-24126 is considered a high severity vulnerability due to its potential for argument injection in the SSH management console.
How do I fix CVE-2026-24126?
To fix CVE-2026-24126, update Weblate to version 5.16.0 or later as provided in the patches.
What kind of vulnerability is CVE-2026-24126?
CVE-2026-24126 is an argument injection vulnerability affecting the SSH host key handling in the management console.
What are the potential impacts of CVE-2026-24126?
The potential impact of CVE-2026-24126 includes unauthorized command execution through invalid input handling.
What workaround exists for CVE-2026-24126?
A workaround for CVE-2026-24126 is to properly restrict access to the management console to mitigate the risk.