CVE-2026-39845: Weblate: SSRF via the webhook add-on using unprotected fetch_url()
Impact The webhook add-on did not utilize existing SSRF protection.
Patches https://github.com/WeblateOrg/weblate/pull/18815
Workarounds Disabling the add-on would avoid misusing this.
References Thanks to @Lihfdgjr for reporting this via GitHub.
Other sources
Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.
— NVD
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39845?
CVE-2026-39845 has a high severity rating due to its exploitation potential in SSRF attacks.
What does CVE-2026-39845 affect?
CVE-2026-39845 affects the Weblate webhook add-on in versions prior to 5.17.
How do I fix CVE-2026-39845?
To fix CVE-2026-39845, upgrade Weblate to version 5.17 or later.
What is an SSRF vulnerability in the context of CVE-2026-39845?
In the context of CVE-2026-39845, SSRF refers to a server-side request forgery vulnerability allowing attackers to send requests to internal resources.
Are there workarounds for CVE-2026-39845 if I cannot upgrade?
If unable to upgrade for CVE-2026-39845, you can implement network-level protections to restrict where the webhook add-on can send requests.