CVE-2026-77573: Weblate: DNS rebinding in VCS operations allows server-side request forgery
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate validates the hostname's first DNS resolution, but the external VCS clients that later connect perform a separate DNS lookup, so an attacker-controlled hostname that initially resolves to a public address can be re-pointed to an internal or private address before the connection is made. By triggering a clone, fetch, push, or similar remote operation, the attacker can cause Weblate to reach internal VCS-compatible services and potentially expose private repository contents. Installations that permit untrusted repository hostnames while using VCSRESTRICTPRIVATE=True are affected. This issue is fixed in version 2026.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Weblateto a version that resolves this vulnerability.Fixed in 2026.8 - Configuration
Ensure VCS_RESTRICT_PRIVATE is set to True to restrict untrusted repository hostnames from accessing private/internal VCS endpoints during VCS operations (issue affects installations that permit untrusted repository hostnames while using VCS_RESTRICT_PRIVATE=True).
Weblate VCS_RESTRICT_PRIVATE = True
Event History
Frequently Asked Questions
Which installations are affected?
Installations that allow untrusted repository hostnames while VCS_RESTRICT_PRIVATE=True is enabled are affected. The issue applies to versions earlier than 2026.8.
What level of access does an attacker need?
The attacker needs permission to manage component repository URLs. They must control a hostname and be able to change its DNS resolution between Weblate's initial validation and the VCS client's later connection.
What actions can trigger the vulnerable connection?
A clone, fetch, push, or similar remote VCS operation can trigger the connection. This can cause Weblate to contact internal VCS-compatible services and may expose private repository contents.
How can the risk be reduced if upgrading is not immediately possible?
Do not permit untrusted users to configure repository hostnames or URLs. Restrict repository URLs to trusted hosts until version 2026.8 can be installed.