CVE-2026-77573

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate validates the hostname's first DNS resolution, but the external VCS clients that later connect perform a separate DNS lookup, so an attacker-controlled hostname that initially resolves to a public address can be re-pointed to an internal or private address before the connection is made. By triggering a clone, fetch, push, or similar remote operation, the attacker can cause Weblate to reach internal VCS-compatible services and potentially expose private repository contents. Installations that permit untrusted repository hostnames while using VCS_RESTRICT_PRIVATE=True are affected. This issue is fixed in version 2026.8.

• CWE-367
• CWE-918

• https://github.com/WeblateOrg/weblate/commit/3f31f094eb4f99587607af0085d4fb35461454a1
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-45m9-pf98-8jmq

Published

Aug 26, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77560Tinyauth is an authentication and authorization server. Prio…8.1
• CVE-2026-77561Tinyauth is an authentication and authorization server. Prio…5.3
• CVE-2026-77564Talos Linux is a Linux distribution built for Kubernetes dep…3.3
• CVE-2026-77567Filament is a collection of full-stack components for accele…8.1
• CVE-2026-77568Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-77572VeraCrypt provides disk encryption with strong security base…3.3
• CVE-2026-77581BentoPDF is a client-side PDF toolkit that is self hostable.…8.6
• CVE-2026-77582Tinyauth is an authentication and authorization server. Prio…6.9
• CVE-2026-77584Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that …8.2
• CVE-2026-77585The Okta Privileged Access client does not reject a leading …5.3
• CVE-2026-77586In MongoDB Connector for BI, MongoDB object names such as co…8
• CVE-2026-77587Tor before 0.4.9.11 is prone to a use-after-free (and potent…7.5