Every CVE Search/ Get API key

CVE-2026-24126

Weblate has an argument injection in management console

6.6 MediumPublic exploitFix available

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to ssh-add. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.52%Up 0.5 points since Feb 19, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.6

Weblate has an argument injection in management console

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to ssh-add. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

Record
CVE-2026-24126
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-88
Updated
2026-11-02
EUVDEUVD-2026-8105 6.6

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to ssh-add. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

Record
EUVD-2026-8105
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-33fm-6gp7-4p47 6.6

Weblate has an argument injection in management console

Impact

The SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to ssh-add.

Patches

Workarounds

Properly limit access to the management console.

References

This issue was reported to us by alexb_616 via HackerOne.

Record
GHSA-33fm-6gp7-4p47
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-88
Updated
2026-11-02
NVD 6.6

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to ssh-add. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

Record
CVE-2026-24126
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-88
Updated
2026-11-02
OSV 6.6

Weblate has an argument injection in management console

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to ssh-add. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

Record
CVE-2026-24126
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-88
Updated
2026-11-02
OSVGHSA-33fm-6gp7-4p47 6.6

Weblate has an argument injection in management console

Impact

The SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to ssh-add.

Patches

Workarounds

Properly limit access to the management console.

References

This issue was reported to us by alexb_616 via HackerOne.

Record
GHSA-33fm-6gp7-4p47
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-88
Updated
2026-11-02
OSVPYSEC-2026-2309 9.1

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to ssh-add. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

Record
PYSEC-2026-2309
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
weblate
PyPI
 before 5.16.0
5.16.0
weblate
PyPI
 before 5.16.0, plus listed versions
1.92.02.12.102.10.1
Show 45 moreShow less
2.112.122.132.13.12.142.14.12.152.162.172.17.12.182.192.19.12.22.202.32.42.52.62.72.82.93.03.0.13.13.1.13.103.10.13.10.23.10.33.113.11.13.11.23.11.33.23.2.13.2.23.33.43.53.5.13.63.6.13.73.7.1
5.16.0
weblate
PyPI
 before 5.16, plus listed versions
1.92.02.12.102.10.1
Show 45 moreShow less
2.112.122.132.13.12.142.14.12.152.162.172.17.12.182.192.19.12.22.202.32.42.52.62.72.82.93.03.0.13.13.1.13.103.10.13.10.23.10.33.113.11.13.11.23.11.33.23.2.13.2.23.33.43.53.5.13.63.6.13.73.7.1
5.16

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubalexb616/Weblate-CVE-2026-241262026-03-26

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-24126 is a medium vulnerability (CVSS 6.6) in Weblate, published February 17, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in weblate 5.16.0.

References

This page doesn't list everything

Left out here: 220 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open