CVE-2026-77573

Received Received - Intake

Server-Side Request Forgery in Weblate via DNS Rebinding

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate validates the hostname's first DNS resolution, but the external VCS clients that later connect perform a separate DNS lookup, so an attacker-controlled hostname that initially resolves to a public address can be re-pointed to an internal or private address before the connection is made. By triggering a clone, fetch, push, or similar remote operation, the attacker can cause Weblate to reach internal VCS-compatible services and potentially expose private repository contents. Installations that permit untrusted repository hostnames while using VCS_RESTRICT_PRIVATE=True are affected. This issue is fixed in version 2026.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-77573

Affected Vendors & Products

Vendor	Product	Version / Range
weblate	weblate	to 2026.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side request forgery (SSRF) issue in Weblate versions before 2026.8. It allows a user with permission to manage component repository URLs to exploit DNS rebinding during version control system (VCS) operations. The attacker can cause Weblate to connect to internal services by changing the DNS resolution of a hostname from a public address to an internal one after initial validation.

Detection Guidance

Detecting this vulnerability requires checking Weblate versions prior to 2026.8 and verifying if VCS_RESTRICT_PRIVATE is set to True while allowing untrusted repository hostnames. Inspect Weblate logs for unusual VCS operations or DNS rebinding attempts during repository interactions.

Impact Analysis

If exploited, this vulnerability could allow an attacker to access internal VCS-compatible services and potentially expose private repository contents. This is especially risky if your Weblate instance permits untrusted repository hostnames and uses VCS_RESTRICT_PRIVATE=True.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing private repository contents to unauthorized internal access. If an attacker exploits this to reach internal VCS-compatible services, sensitive data might be accessed or leaked, violating confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade Weblate to version 2026.8 or later immediately. Disable VCS_RESTRICT_PRIVATE if it is currently enabled and untrusted repository hostnames are permitted. Review and restrict access to repository management features for untrusted users.

Hi! I’m here to help you understand CVE-2026-77573. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70