CVE-2026-34244
published 2026-04-15CVE-2026-34244: Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role)…
PriorityP432medium5CVSS 3.1
AVNACLPRLUINSCCLINAN
EPSS
0.33%
23.2th percentile
Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machinery services via WEBLATE_MACHINERY setting.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| weblate | weblate | < 5.17 | 5.17 |
| weblate | weblate | >= 0 < 5.17 | 5.17 |
| weblateorg | weblate | < 517 | 517 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
weblate up to 5.16 Error Message WEBLATE_MACHINERY server-side request forgery (GHSA-xrwr-fcw6-fmq8)
vuldb·2026-04-16·CVSS 5.0
CVE-2026-34244 [MEDIUM] weblate up to 5.16 Error Message WEBLATE_MACHINERY server-side request forgery (GHSA-xrwr-fcw6-fmq8)
A vulnerability labeled as critical has been found in weblate up to 5.16. Affected by this vulnerability is an unknown functionality of the component Error Message Handler. Executing a manipulation of the argument WEBLATE_MACHINERY can lead to server-side request forgery.
This vulnerability appears as CVE-2026-34244. The attack may be performed from remote. There is no available exploit.
The affected component should be upgraded.
GHSA
Weblate: SSRF via Project-Level Machinery Configuration
ghsa·2026-04-16
CVE-2026-34244 [MEDIUM] CWE-200 Weblate: SSRF via Project-Level Machinery Configuration
Weblate: SSRF via Project-Level Machinery Configuration
### Impact
A user with the `project.edit` permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read.
### Patches
* https://github.com/WeblateOrg/weblate/pull/18684
* The solution then has been cleaned up in followup patches
### Workarounds
Limiting available machinery services via WEBLATE_MACHINERY setting can avoid this.
### References
Thanks to @DavidCarliez for di
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-15
Published