CVE-2026-62364: wlc API Token Disclosure Vulnerability in Untrusted Configurations
Summary
CVE-2026-62364: wlc may disclose API tokens to project-configured URLs. Affects wlc versions < 2.0.1. Fixed in 2.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wlc is a command-line tool designed for interacting with the Weblate translation management system. It allows users to automate various tasks related to translation projects, including uploading and downloading translations. The tool is widely used in environments where translation workflows are integrated into software development processes. However, it has a vulnerability that can expose sensitive API tokens when run in directories with untrusted configurations.
Vulnerability Detail
The vulnerability arises when wlc is executed in a directory tree that contains project configurations controlled by an attacker. If the user provides an API token via the WLC_KEY environment variable or the --key command-line option without specifying a corresponding API URL, wlc may inadvertently send the token to a project-configured URL. This can lead to unauthorized access to sensitive data, as the API token is unscoped and can be used by the attacker to interact with the API on behalf of the user.
How To Fix
Minimum fixed version
2.0.1
This is the first release that contains the fix.
pip install --upgrade "wlc==2.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, users can avoid the issue by explicitly pinning the API URL whenever using an unscoped key. For example: WLC_URL=https://hosted.weblate.org/api/ WLC_KEY=... wlc ... or wlc --url https://hosted.weblate.org/api/ --key ... Alternatively, users can utilize URL-scoped keys in the [keys] section of the configuration instead of using WLC_KEY or --key.
Conclusion
In summary, the wlc tool has a vulnerability that can expose API tokens when run in untrusted configurations. Users are advised to upgrade to version 2.0.1 or newer to mitigate this risk. If upgrading is not feasible, specific workarounds can be employed to protect sensitive information.
See every vulnerability recorded for wlc →
FAQ
The vulnerability can lead to the disclosure of API tokens to unintended servers, potentially allowing unauthorized access to sensitive data.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring sign-up.
If upgrading is not an option, ensure to pin the API URL when using unscoped keys or use URL-scoped keys in your configuration.
The CVSS score for this vulnerability is 2.3, indicating a low severity level.
The issue was independently reported by security researchers type5afe and visionx7 through HackerOne.
References
Related vulnerabilities
Recent vulnerabilities recorded for wlc.
