CVE-2026-24126: Weblate SSH Management Console Argument Injection Vulnerability
Summary
CVE-2026-24126: Weblate has an argument injection in management console. Affects weblate versions < 5.16.0. Fixed in 5.16.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is an open-source web-based translation management system that facilitates collaborative translation efforts. It allows users to manage translation projects, track changes, and integrate with various version control systems. The platform is designed to streamline the translation workflow, making it easier for teams to collaborate effectively. However, a recent vulnerability has been identified in its SSH management console, which could potentially compromise the security of the system.
Vulnerability Detail
The vulnerability arises from the SSH management console's failure to validate input when adding SSH host keys. This oversight can lead to argument injection in the ssh-add command, allowing an attacker to execute arbitrary commands or manipulate SSH keys. The lack of input validation poses a significant risk, as it could enable unauthorized access to sensitive systems or data, potentially leading to further exploitation.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.16.0
This is the first release that contains the fix.
pip install --upgrade "weblate==5.16.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to limit access to the management console to trusted users only. This can be achieved by implementing strict access controls and ensuring that only authorized personnel can add SSH host keys.
Conclusion
In summary, CVE-2026-24126 represents a significant security risk for users of Weblate due to an argument injection vulnerability in the SSH management console. It is crucial for users to update to the latest version to mitigate this risk and ensure the security of their translation management systems.
See every vulnerability recorded for weblate →
FAQ
CVE-2026-24126 is a vulnerability in Weblate's SSH management console that allows for argument injection due to improper input validation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to systems, execution of arbitrary commands, and potential data breaches due to compromised SSH keys.
Yes, the vulnerability has been patched in version 5.16.0 of Weblate. Users are encouraged to upgrade to this version.
The CVSS score of this vulnerability is 6.6, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
