CVE-2026-39845: Weblate SSRF in webhook add-on via fetch_url

Executive brief

Weblate is a web-based translation and localization tool. A security flaw in its webhook add-on allows high-privileged users to bypass internal network protections. This could allow an attacker to probe or access internal services that are not intended to be reachable from the internet.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Weblate's webhook add-on due to the use of an unprotected fetch_url() function. The component fails to apply existing SSRF protections when processing webhook requests. An attacker with high privileges (PR:H) can exploit this over the network to make the server send requests to arbitrary internal or external URLs. This can lead to unauthorized information disclosure from internal services. The issue is fixed in version 5.17.

Affected products

• WeblateOrg weblate < 5.17

Timeline

• 2026-04-15: disclosed
• 2026-04-16: advisory
• 2026-04-15: patched: Version 5.17 released

References

• https://api.github.com/users/nijel
• https://github.com/nijel
• https://api.github.com/users/nijel/gists%7B/gist_id%7D
• https://api.github.com/users/nijel/repos
• https://avatars.githubusercontent.com/u/212189?v=4
• https://api.github.com/users/nijel/events%7B/privacy%7D