CVE-2026-22250

wlc can skip SSL verification

2.5 LowFix available

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.15%Up 0.1 points since Jan 13, 2026

What each source reports

CVE List Score used 2.5

wlc can skip SSL verification

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.

Record: CVE-2026-22250
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
Weakness: CWE-295
Updated: 2026-11-02

EUVDEUVD-2026-1920 2.5

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.

Record: EUVD-2026-1920
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-2mmv-7rrp-g8xh 2.5

Weblate command-line client susceptible to SSL verification skip

Impact

The SSL verification would be skipped for some crafted URLs.

Patches

https://github.com/WeblateOrg/wlc/pull/1097

Workarounds

Avoid using untrusted wlc configurations, as that might cause insecure connections.

References

This issue was reported to us by wh1zee via HackerOne.

Record: GHSA-2mmv-7rrp-g8xh
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
Weakness: CWE-295
Updated: 2026-11-02

NVD 2.5

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.

Record: CVE-2026-22250
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-295
Updated: 2026-11-02

OSV 2.5

wlc can skip SSL verification

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.

Record: CVE-2026-22250
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
Weakness: CWE-295
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-22250 5.5

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.

Record: DEBIAN-CVE-2026-22250
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Show 4 moreShow less

OSVGHSA-2mmv-7rrp-g8xh 2.5

Weblate command-line client susceptible to SSL verification skip

Impact

The SSL verification would be skipped for some crafted URLs.

Patches

https://github.com/WeblateOrg/wlc/pull/1097

Workarounds

Avoid using untrusted wlc configurations, as that might cause insecure connections.

References

This issue was reported to us by wh1zee via HackerOne.

Record: GHSA-2mmv-7rrp-g8xh
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
Weakness: CWE-295
Updated: 2026-11-02

OSVPYSEC-2026-2051 2.5

Weblate command-line client susceptible to SSL verification skip

Impact

The SSL verification would be skipped for some crafted URLs.

Patches

https://github.com/WeblateOrg/wlc/pull/1097

Workarounds

Avoid using untrusted wlc configurations, as that might cause insecure connections.

References

This issue was reported to us by wh1zee via HackerOne.

Record: PYSEC-2026-2051
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-22250 2.5

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.

Record: UBUNTU-CVE-2026-22250
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVUSN-7981-1 No score

wlc vulnerabilities

It was discovered that wlc did not correctly handle SSL verification. An attacker could possibly use this issue to access sensitive resources. (CVE-2026-22250)

It was discovered that wlc did not correctly handle API keys. An attacker could possibly use this issue to leak API keys to a malicious server. (CVE-2026-22251)

Record: USN-7981-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`wlc` PyPI	before 1.17.0	1.17.0
`wlc` Debian:12	All versions, plus listed versions 1.13-21.14-11.15-11.15-21.16.1-11.17.2-12.0.0-1	None known
`wlc` Debian:13	All versions, plus listed versions 1.15-11.15-21.16.1-11.17.2-12.0.0-1	None known
`wlc` Debian:14	before 1.17.2-1, plus listed versions 1.15-11.15-21.16.1-1	1.17.2-1
`wlc` PyPI	before 1.17.0, plus listed versions 0.00.10.100.20.3 Show 23 moreShow less 0.40.50.60.70.80.91.01.11.101.111.121.131.141.151.16.11.21.31.41.51.61.71.81.9	1.17.0
`wlc` Ubuntu:Pro:18.04:LTS	before 0.8-1ubuntu0.1~esm1, plus listed versions 0.8-1	0.8-1ubuntu0.1~esm1
`wlc` Ubuntu:Pro:20.04:LTS	before 1.2-1ubuntu0.20.04.1~esm1, plus listed versions 1.1-11.2-1	1.2-1ubuntu0.20.04.1~esm1
`wlc` Ubuntu:Pro:22.04:LTS	before 1.2-1ubuntu0.22.04.1~esm1, plus listed versions 1.2-1	1.2-1ubuntu0.22.04.1~esm1
`wlc` Ubuntu:Pro:24.04:LTS	before 1.13-2ubuntu0.1~esm1, plus listed versions 1.13-2	1.13-2ubuntu0.1~esm1
`wlc` Ubuntu:25.10	before 1.15-2ubuntu0.1, plus listed versions 1.15-11.15-2	1.15-2ubuntu0.1

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`wlc` Ubuntu:26.10	All versions, plus listed versions 1.16.1-12.0.0-1	None known
`wlc` Ubuntu:26.04:LTS	All versions, plus listed versions 1.15-21.16.1-1	None known
`wlc` Ubuntu:Pro:18.04:LTS From an advisory covering 2 CVEs	before 0.8-1ubuntu0.1~esm1, plus listed versions 0.8-1	0.8-1ubuntu0.1~esm1
`wlc` Ubuntu:Pro:20.04:LTS From an advisory covering 2 CVEs	before 1.2-1ubuntu0.20.04.1~esm1, plus listed versions 1.1-11.2-1	1.2-1ubuntu0.20.04.1~esm1
`wlc` Ubuntu:Pro:22.04:LTS From an advisory covering 2 CVEs	before 1.2-1ubuntu0.22.04.1~esm1, plus listed versions 1.2-1	1.2-1ubuntu0.22.04.1~esm1
`wlc` Ubuntu:Pro:24.04:LTS From an advisory covering 2 CVEs	before 1.13-2ubuntu0.1~esm1, plus listed versions 1.13-2	1.13-2ubuntu0.1~esm1
`wlc` Ubuntu:25.10 From an advisory covering 2 CVEs	before 1.15-2ubuntu0.1, plus listed versions 1.15-11.15-2	1.15-2ubuntu0.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-22250 is a low vulnerability (CVSS 2.5) in Weblate Wlc, published January 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in wlc 1.17.0.

References

Show 7 moreShow less