# CVE-2026-34244: Weblate SSRF in Project-Level Machinery Configuration

Source: https://junglewise.ai/threats/cve-2026-34244-weblate-ssrf-in-project-level-machinery-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-15. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-34244 · Severity: medium · CVSS 5 · Published 2026-04-15

Weblate, a web-based translation tool, is vulnerable to a security flaw where authorized project administrators can probe internal network services. By configuring a malicious translation service URL, an attacker can force the server to make requests to internal systems and view parts of the response. This could lead to the exposure of sensitive information from internal infrastructure that is not otherwise accessible from the internet.

Technologies: [weblate (PyPI)](https://junglewise.ai/threats/technologies/weblate), [Weblate](https://junglewise.ai/threats/technologies/weblate-weblate). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Weblate](https://junglewise.ai/threats/vendors/weblate).

## Quick answers

**Is CVE-2026-34244 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34244 being exploited in the wild.

**How severe is CVE-2026-34244?** Medium severity, with a CVSS score of 5, published 15 April 2026.

**Which products and versions are affected?** weblate (PyPI) < 5.17, ECOSYSTEM:introduced=0,fixed=5.17.

**Is there a fix for CVE-2026-34244?** Yes. weblate (PyPI): upgrade to 5.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34244 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34244?** Check whether you run weblate (PyPI) or Weblate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- weblate (PyPI): upgrade to 5.17 or later

  ```sh
  pip install "weblate>=5.17"
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Weblate's machine translation configuration. Users with 'project.edit' permissions (typically the per-project Administration role) can specify arbitrary URLs for machinery services. During the configuration validation phase, the application performs an HTTP request to the user-provided URL. If the request fails or returns an error, Weblate reflects up to 200 characters of the response body back to the user in an error message. This allows for internal network scanning and partial data exfiltration from internal services. The issue is fixed in version 5.17.

## Affected products

- WeblateOrg Weblate < 5.17

## Identifiers

- CVE-2026-34244
- GHSA-xrwr-fcw6-fmq8
- PYSEC-2026-2314

## Timeline

- 2026-04-15: patched: Version 5.17 released
- 2026-04-16: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/DavidCarliez](https://api.github.com/users/DavidCarliez)
- [https://github.com/DavidCarliez](https://github.com/DavidCarliez)
- [https://api.github.com/users/DavidCarliez/gists%7B/gist_id%7D](https://api.github.com/users/DavidCarliez/gists%7B/gist_id%7D)
- [https://api.github.com/users/DavidCarliez/repos](https://api.github.com/users/DavidCarliez/repos)
- [https://avatars.githubusercontent.com/u/271374756?v=4](https://avatars.githubusercontent.com/u/271374756?v=4)
- [https://api.github.com/users/DavidCarliez/events%7B/privacy%7D](https://api.github.com/users/DavidCarliez/events%7B/privacy%7D)

## Related threats

- [Weblate argument injection in Mercurial backend](https://junglewise.ai/threats/cve-2026-86035-weblate-is-a-web-based-continuous-localization-platform-used-to)
- [Weblate IDOR in GroupViewSet authorization bypass](https://junglewise.ai/threats/cve-2026-55228-weblate-idor-in-groupviewset-authorization-bypass)
- [Weblate observable object existence disclosure via HTTP status codes](https://junglewise.ai/threats/cve-2026-55227-weblate-observable-object-existence-disclosure-via-http-status)
- [PYSEC-2026-2037 - Weblate leaks information via screenshots](https://junglewise.ai/threats/cve-2026-21889-weblate-information-disclosure-via-unprotected-screenshots)
- [PYSEC-2026-2040 - Weblate has an arbitrary file read via symbolic links](https://junglewise.ai/threats/cve-2025-68279-weblate-has-an-arbitrary-file-read-via-symbolic-links)