CVE-2026-50127: Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)
Impact
Weblate's VCSRESTRICTPRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.
Patches
https://github.com/WeblateOrg/weblate/pull/19768
Resources
The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.
Other sources
Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCSRESTRICTPRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. This issue has been patched in version 2026.6.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/weblateto a version that resolves this vulnerability.Fixed in 2026.6 - Upgrade
Upgrade
Weblateto a version that resolves this vulnerability.Fixed in 2026.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50127?
The severity of CVE-2026-50127 is medium with a score of 5.9.
What does CVE-2026-50127 affect?
CVE-2026-50127 affects Weblate versions from 5.15 to before 2026.6.
How do I fix CVE-2026-50127?
To fix CVE-2026-50127, upgrade to Weblate version 2026.6 or later.
What type of vulnerability is CVE-2026-50127?
CVE-2026-50127 is a Server-Side Request Forgery (SSRF) vulnerability.
What impact does CVE-2026-50127 have?
CVE-2026-50127 allows certain addresses to bypass private range restrictions, potentially compromising the security of the application.