CVE-2026-22250: wlc Package SSL Verification Bypass Vulnerability
Summary
CVE-2026-22250: Weblate command-line client susceptible to SSL verification skip. Affects wlc versions < 1.17.0. Fixed in 1.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wlc package is a command-line client for Weblate, a web-based translation tool that facilitates collaborative translation efforts. It allows users to interact with Weblate's services through a terminal interface, making it easier to manage translations and updates. However, this package is susceptible to a vulnerability that allows SSL verification to be skipped for certain crafted URLs, potentially exposing users to security risks.
Vulnerability Detail
The vulnerability arises from the wlc package's handling of SSL verification. Specifically, it allows SSL verification to be bypassed for certain specially crafted URLs. This can lead to insecure connections, where sensitive data could be intercepted by malicious actors. The issue is classified under CWE-295, which pertains to improper certificate validation. The ramifications of this vulnerability include the risk of man-in-the-middle attacks, where an attacker could impersonate a trusted server and intercept or manipulate data transmitted between the client and server.
How To Fix
Latest published version: 3.1.0 as of 23 Oct 2026
pip install --upgrade "wlc==3.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.17.0
This is the first release that contains the fix.
pip install --upgrade "wlc==1.17.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using untrusted wlc configurations, as this may lead to insecure connections. Ensure that all URLs used with the wlc client are from trusted sources.
Conclusion
The wlc package is vulnerable to an SSL verification bypass issue, which can lead to insecure connections and potential data interception. Users are strongly advised to update to the latest version to mitigate this risk and ensure secure communication.
See every vulnerability recorded for wlc →
FAQ
The vulnerability allows SSL verification to be skipped for certain crafted URLs, potentially leading to insecure connections.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
Update the wlc package to version 1.17.0 or later using the command 'pip install --upgrade wlc'.
The risks include potential man-in-the-middle attacks, where an attacker could intercept or manipulate data transmitted between the client and server.
The CVSS score of this vulnerability is 2.5, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for wlc.
