CVE-2026-62364: wlc may disclose API tokens to project-configured URLs
Impact
wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration.
If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL, wlc would send the token to the project-configured URL.
Impacted users are those running wlc in untrusted repositories, pull request checkouts, or directories with untrusted ancestor configuration while using WLCKEY or --key.
Patches
The issue is patched in wlc 2.0.1 via https://github.com/WeblateOrg/wlc/pull/1500.
The fix rejects unscoped keys when the API URL comes from automatically discovered project configuration:
- WLCKEY now requires WLCURL. - --key now requires --url. - URL-scoped keys in the [keys] configuration section remain supported.
Users should upgrade to wlc 2.0.1 or newer.
Workarounds
Without upgrading, users can avoid the issue by explicitly pinning the API URL whenever using an unscoped key:
WLCURL=https://hosted.weblate.org/api/ WLCKEY=... wlc ...
or:
wlc --url https://hosted.weblate.org/api/ --key ... ...
Alternatively, use URL-scoped keys in the [keys] section instead of WLCKEY or --key, and avoid running wlc with secrets in untrusted checkouts.
- The issue was independently reported by type5afe and visionx7 using HackerOne.
Other sources
wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc runs in an untrusted repository, pull request checkout, or directory with untrusted ancestor configuration, it can send the token to an attacker-controlled project-configured URL. URL-scoped keys in [keys] are not affected. This issue is fixed in version 2.0.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/wlcto a version that resolves this vulnerability.Fixed in 2.0.1 - Upgrade
Upgrade
wlcto a version that resolves this vulnerability.Fixed in 2.0.1 - Compensating control
When using an unscoped API key, explicitly pin the API URL: set WLC_URL together with WLC_KEY, or use wlc --url together with --key. Alternatively, use URL-scoped keys in the [keys] configuration section.
Event History
Frequently Asked Questions
Which deployments are exposed to token disclosure?
wlc versions before 2.0.1 are exposed when an unscoped API token is provided through WLC_KEY or --key and the API URL is selected from automatically discovered .weblate, .weblate.ini, or weblate.ini configuration. This is relevant when running in an untrusted repository, pull request checkout, or a directory with untrusted ancestor configuration.
What must an attacker control to receive the token?
An attacker needs to cause discovered project or ancestor configuration to select an attacker-controlled API URL while wlc is run with an unscoped token and without a matching WLC_URL or --url. User interaction is required, as reflected by the need to run wlc in the affected directory or checkout.
Are URL-scoped API keys affected?
No. Keys scoped to URLs in the [keys] configuration section are not affected.
What can be done if upgrading is not immediately possible?
Avoid running wlc with WLC_KEY or --key in untrusted repositories, pull request checkouts, or directories whose ancestor configuration is not trusted. Supplying a matching WLC_URL or --url, or using URL-scoped keys in [keys], avoids the described exposure condition.
How can I determine whether a run may have been exposed?
Review whether wlc before 2.0.1 was run with WLC_KEY or --key but without WLC_URL or --url, while configuration could have been discovered from .weblate, .weblate.ini, or weblate.ini in an untrusted project or ancestor directory. Such runs may have sent the token to the API URL selected by that configuration.