Vulnerability Description
Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machinery services via WEBLATE_MACHINERY setting.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Weblate | Weblate | < 5.17 |
Related Weaknesses (CWE)
References
- https://github.com/WeblateOrg/weblate/commit/e619e9090202e4886b844c110d39308e7e8Patch
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-xrwr-fcw6-fmq8Third Party Advisory
FAQ
What is CVE-2026-34244?
CVE-2026-34244 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation servic...
How severe is CVE-2026-34244?
CVE-2026-34244 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-34244?
Check the references section above for vendor advisories and patch information. Affected products include: Weblate Weblate.