{"id":"CVE-2026-22250","aliases":["DEBIAN-CVE-2026-22250","EUVD-2026-1920","GHSA-2mmv-7rrp-g8xh","PYSEC-2026-2051","UBUNTU-CVE-2026-22250","USN-7981-1"],"status":"published","title":"wlc can skip SSL verification","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.","severity":{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00154,"percentile":0.04554,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2026-01-12T16:13:33Z","modified":"2026-10-28T02:30:46Z","fixes":[{"ecosystem":"PyPI","package":"wlc","fixed_in":["1.17.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"wlc","fixed_in":["1.17.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"wlc","fixed_in":["0.8-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"wlc","fixed_in":["1.2-1ubuntu0.20.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"wlc","fixed_in":["1.2-1ubuntu0.22.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"wlc","fixed_in":["1.13-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"wlc","fixed_in":["1.15-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13-2","1.14-1","1.15-1","1.15-2","1.16.1-1","1.17.2-1","2.0.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15-1","1.15-2","1.16.1-1","1.17.2-1","2.0.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.2-1"}]}],"versions":["1.15-1","1.15-2","1.16.1-1"]},{"source":"osv","ecosystem":"PyPI","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0"}]}],"versions":["0.0","0.1","0.10","0.2","0.3","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16.1","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9"]},{"source":"osv","ecosystem":"PyPI","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0"}]}],"versions":["0.0","0.1","0.10","0.2","0.3","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16.1","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-1ubuntu0.1~esm1"}]}],"versions":["0.8-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-1ubuntu0.20.04.1~esm1"}]}],"versions":["1.1-1","1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-1ubuntu0.22.04.1~esm1"}]}],"versions":["1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-2ubuntu0.1~esm1"}]}],"versions":["1.13-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-2ubuntu0.1"}]}],"versions":["1.15-1","1.15-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-1","2.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15-2","1.16.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-1ubuntu0.1~esm1"}]}],"versions":["0.8-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-1ubuntu0.20.04.1~esm1"}]}],"versions":["1.1-1","1.2-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-1ubuntu0.22.04.1~esm1"}]}],"versions":["1.2-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-2ubuntu0.1~esm1"}]}],"versions":["1.13-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-2ubuntu0.1"}]}],"versions":["1.15-1","1.15-2"],"bundled":2}],"products":[{"vendor":"weblate","product":"wlc"},{"vendor":"weblateorg","product":"wlc"}],"references":[{"url":"https://github.com/WeblateOrg/wlc/security/advisories/GHSA-2mmv-7rrp-g8xh","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/WeblateOrg/wlc/pull/1097","tags":["x_refsource_MISC","Issue Tracking","fix","web","report"]},{"url":"https://github.com/WeblateOrg/wlc/commit/a513864ec4daad00146e6d6e039559726e256fa3","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22250","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2mmv-7rrp-g8xh","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22250.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-22250","tags":["advisory"]},{"url":"https://github.com/WeblateOrg/wlc","tags":["package"]},{"url":"https://pypi.org/project/wlc","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-22250","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22250","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7981-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-22251","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-22250","title":"wlc can skip SSL verification","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.","status":"published","published":"2026-01-12T17:52:01.39Z","modified":"2026-01-12T18:07:33.376Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T13:39:05.585774Z"}],"euvd":[{"id":"EUVD-2026-1920","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.","status":"published","published":"2026-01-12T17:52:01Z","modified":"2026-01-12T18:07:33Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T19:48:53.22038Z"}],"ghsa":[{"id":"GHSA-2mmv-7rrp-g8xh","title":"Weblate command-line client susceptible to SSL verification skip","description":"### Impact\nThe SSL verification would be skipped for some crafted URLs.\n\n### Patches\n* https://github.com/WeblateOrg/wlc/pull/1097\n\n### Workarounds\nAvoid using untrusted wlc configurations, as that might cause insecure connections.\n\n### References\nThis issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.","status":"published","published":"2026-01-12T16:13:33Z","modified":"2026-01-12T20:07:43Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:39:17.333958Z"}],"nvd":[{"id":"CVE-2026-22250","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.","status":"published","published":"2026-01-12T18:15:49.307Z","modified":"2026-06-17T10:19:38.147Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:12:03.683495Z"}],"osv":[{"id":"CVE-2026-22250","title":"wlc can skip SSL verification","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.","status":"published","published":"2026-01-12T17:52:01.39Z","modified":"2026-10-28T02:30:46.002716493Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"DEBIAN-CVE-2026-22250","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.","status":"published","published":"2026-01-12T18:15:49.307Z","modified":"2026-10-01T03:03:08.210105289Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"GHSA-2mmv-7rrp-g8xh","title":"Weblate command-line client susceptible to SSL verification skip","description":"### Impact\nThe SSL verification would be skipped for some crafted URLs.\n\n### Patches\n* https://github.com/WeblateOrg/wlc/pull/1097\n\n### Workarounds\nAvoid using untrusted wlc configurations, as that might cause insecure connections.\n\n### References\nThis issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.","status":"published","published":"2026-01-12T16:13:33Z","modified":"2026-07-07T17:56:07.551313659Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"PYSEC-2026-2051","title":"Weblate command-line client susceptible to SSL verification skip","description":"### Impact\nThe SSL verification would be skipped for some crafted URLs.\n\n### Patches\n* https://github.com/WeblateOrg/wlc/pull/1097\n\n### Workarounds\nAvoid using untrusted wlc configurations, as that might cause insecure connections.\n\n### References\nThis issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.","status":"published","published":"2026-07-07T16:03:18.118006Z","modified":"2026-07-07T17:46:16.679584751Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2026-22250","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.","status":"published","published":"2026-01-12T18:15:00Z","modified":"2026-10-17T12:58:06.931286375Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"USN-7981-1","title":"wlc vulnerabilities","description":"It was discovered that wlc did not correctly handle SSL verification. An\nattacker could possibly use this issue to access sensitive resources.\n(CVE-2026-22250)\n\nIt was discovered that wlc did not correctly handle API keys. An attacker\ncould possibly use this issue to leak API keys to a malicious server.\n(CVE-2026-22251)","status":"published","published":"2026-01-27T18:14:03Z","modified":"2026-04-27T18:33:26.953736Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}