CVE-2026-34244: Weblate: SSRF via Project-Level Machinery Configuration
Impact A user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read.
Patches
https://github.com/WeblateOrg/weblate/pull/18684 The solution then has been cleaned up in followup patches
Workarounds Limiting available machinery services via WEBLATEMACHINERY setting can avoid this.
References
Thanks to @DavidCarliez for disclosing this via GitHub private vulnerability reporting.
Other sources
Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machinery services via WEBLATEMACHINERY setting.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34244?
CVE-2026-34244 has a medium severity level due to the potential for SSRF attacks leading to unauthorized access to internal networks.
How do I fix CVE-2026-34244?
To fix CVE-2026-34244, upgrade your Weblate installation to version 5.17 or later.
Who is affected by CVE-2026-34244?
CVE-2026-34244 affects all users of Weblate prior to version 5.17 with project.edit permissions.
What type of vulnerability is CVE-2026-34244?
CVE-2026-34244 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
What can an attacker do with CVE-2026-34244?
An attacker exploiting CVE-2026-34244 can configure machine translation service URLs to access arbitrary internal network resources.