CVE-2026-22251
API Key Exposure in wlc Client via Unscoped Keys
Publication date: 2026-01-12
Last updated on: 2026-01-12
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| weblate | client | to 1.17.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22251 is a security vulnerability in the Weblate command-line client (wlc) where unscoped API keys could be loaded from system-wide or arbitrary configuration files. This insecure practice could cause API keys to be leaked to unintended or different servers, exposing sensitive tokens. The vulnerability arises because wlc previously allowed API keys to be specified outside of the dedicated [keys] section or via unscoped settings, increasing the risk of token leakage. The fix restricts key loading to user-specific [keys] sections or command-line arguments, preventing keys from being loaded from system-wide config files and reducing exposure. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to your API keys being leaked or used against unintended servers, potentially exposing sensitive information to unauthorized parties. Because API keys might be loaded from insecure or system-wide configuration files, attackers or other users on the system could gain access to these keys, compromising confidentiality. This could result in unauthorized access to your Weblate resources or data. The impact is primarily on confidentiality, with a moderate severity score (CVSS 5.3). [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability, you should check your wlc configuration files for the presence of unscoped API keys outside the dedicated [keys] section, especially in system-wide config files or general sections like [weblate]. You can search for API keys in config files by running commands such as: 1. On Linux/macOS: `grep -r 'api_key' ~/.config/weblate/` or `grep -r 'api_key' /etc/weblate/` to find keys in user or system config directories. 2. On Windows, check for 'weblate.ini' in %APPDATA% or %LOCALAPPDATA% directories and inspect them for keys outside the [keys] section. 3. Additionally, verify the wlc version installed by running `wlc --version` to ensure it is 1.17.0 or later, which contains the fix. These steps help identify insecure API key configurations that could lead to token leakage. [1, 2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1. Upgrade the wlc client to version 1.17.0 or later, where the insecure unscoped API key support has been removed. 2. Remove any unscoped API keys from your configuration files, ensuring that API keys are only defined in the [keys] section scoped by their corresponding API URLs. 3. Avoid storing API keys in system-wide configuration files; use user-specific config files instead. 4. Prefer providing API keys and URLs via command-line arguments, which take precedence over config files and reduce the risk of leakage. These actions will prevent API keys from being leaked to unintended servers and improve your security posture. [1, 2, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves the potential leakage of API keys to unintended servers due to insecure handling of unscoped API keys in configuration files. This exposure of sensitive authentication tokens could lead to unauthorized access to data or services, which may result in non-compliance with data protection standards and regulations such as GDPR or HIPAA that require safeguarding sensitive information. By leaking API keys, organizations risk unauthorized data access or breaches, which can violate confidentiality and security requirements mandated by these regulations. The fix mitigates this risk by restricting API key loading to user-specific configuration sections and command-line overrides, thereby enhancing security and helping maintain compliance. [1, 2, 3]