CVE-2026-77573

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate validates the hostname's first DNS resolution, but the external VCS clients that later connect perform a separate DNS lookup, so an attacker-controlled hostname that initially resolves to a public address can be re-pointed to an internal or private address before the connection is made. By triggering a clone, fetch, push, or similar remote operation, the attacker can cause Weblate to reach internal VCS-compatible services and potentially expose private repository contents. Installations that permit untrusted repository hostnames while using VCS_RESTRICT_PRIVATE=True are affected. This issue is fixed in version 2026.8.

• CWE-367
• CWE-918

• https://github.com/WeblateOrg/weblate/commit/3f31f094eb4f99587607af0085d4fb35461454a1
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-45m9-pf98-8jmq

Published

Aug 26, 2026

Last Modified

Aug 27, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77551A malicious actor with access to the network and under certa…9
• CVE-2026-77552A malicious actor with access to the network could exploit a…9.8
• CVE-2026-77553A malicious actor with access to the network and low privile…9.9
• CVE-2026-77554A malicious actor with access to the network could exploit a…10
• CVE-2026-77557A malicious actor with access to the network could exploit a…9.8
• CVE-2026-77567Filament is a collection of full-stack components for accele…8.1
• CVE-2026-77584Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that …7
• CVE-2026-77585The Okta Privileged Access client does not reject a leading …5.3
• CVE-2026-77586In MongoDB Connector for BI, MongoDB object names such as co…8
• CVE-2026-77587Tor before 0.4.9.11 is prone to a use-after-free (and potent…5.9
• CVE-2026-7761The Ultimate Member plugin for WordPress is vulnerable to Ac…8.8
• CVE-2026-77611SeaweedFS is a distributed storage system for files and blob…7.1