CVE-2026-50127: Weblate SSRF Vulnerability in Outbound URL Guard
Summary
CVE-2026-50127: Weblate SSRF: outbound URL guard misses some private ranges. Affects weblate versions >= 5.15, < 2026.6. Fixed in 2026.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is a web-based translation management system that facilitates collaborative translation of software and documents. It integrates with various version control systems and provides a user-friendly interface for translators. However, it has been found to have a vulnerability in its outbound URL guard, which is intended to restrict access to private IP ranges.
Vulnerability Detail
The vulnerability arises from the VCS_RESTRICT_PRIVATE feature in Weblate, which fails to adequately account for certain transitional IPv6 ranges, multicast addresses, and some semi-private IPv4 ranges. This oversight allows unauthorized access to these addresses, potentially leading to Server-Side Request Forgery (SSRF) attacks. Such attacks can enable an attacker to interact with internal services or resources that should be protected, posing a significant security risk.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.6
This is the first release that contains the fix.
pip install --upgrade "weblate==2026.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the application at the network level, ensuring that only trusted IP addresses can interact with Weblate. However, this is not a substitute for applying the patch.
Conclusion
In summary, CVE-2026-50127 is a moderate severity vulnerability in Weblate that can lead to SSRF attacks due to improper handling of private IP ranges. It is crucial to update to the patched version 2026.6 or later to mitigate this risk.
See every vulnerability recorded for weblate →
FAQ
CVE-2026-50127 is a vulnerability in Weblate that allows certain private IP ranges to bypass restrictions, potentially leading to SSRF attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
If you cannot update immediately, consider implementing network-level restrictions to limit access to the application as a temporary workaround.
The issue was reported by a user named @tonghuaroot via GitHub, who also contributed the initial patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
