Is CVE-2026-50127 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50127 being exploited in the wild.

How severe is CVE-2026-50127?

Medium severity, with a CVSS score of 5.9, published 10 June 2026.

Which products and versions are affected?

weblate (PyPI) >= 5.15, < 2026.6, ECOSYSTEM:introduced=5.15,fixed=2026.6.

Is there a fix for CVE-2026-50127?

Yes. weblate (PyPI): upgrade to 2026.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50127 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-50127?

Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50127: Weblate SSRF via private range restriction bypass in VCS_RESTRICT_PRIVATE

Q: Is there a fix for CVE-2026-50127?

Yes. weblate (PyPI): upgrade to 2026.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50127 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-50127?

Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50127 · Severity: medium · CVSS 5.9 · Published 2026-06-10

Weblate, a popular web-based translation tool, contains a security flaw in how it restricts network requests to private internal addresses. An attacker could potentially bypass these restrictions to access sensitive internal services or data that should not be reachable from the translation platform. This could lead to the exposure of internal infrastructure details or unauthorized access to private corporate resources.

Technologies: weblate (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-50127 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50127 being exploited in the wild.
How severe is CVE-2026-50127?: Medium severity, with a CVSS score of 5.9, published 10 June 2026.
Which products and versions are affected?: weblate (PyPI) >= 5.15, < 2026.6, ECOSYSTEM:introduced=5.15,fixed=2026.6.
Is there a fix for CVE-2026-50127?: Yes. weblate (PyPI): upgrade to 2026.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50127 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-50127?: Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

weblate (PyPI): upgrade to 2026.6 or later
```
pip install "weblate>=2026.6"
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Weblate due to incomplete IP address filtering in the VCS_RESTRICT_PRIVATE setting. The outbound URL guard fails to properly account for transitional IPv6 ranges, multicast addresses, and specific semi-private IPv4 ranges. A remote attacker can exploit this by providing a crafted URL that bypasses private range restrictions, allowing the server to make requests to internal network resources. The vulnerability is tracked as CVE-2026-50127 and has been addressed in version 2026.6.

Affected products

WeblateOrg weblate >= 5.15, < 2026.6

Identifiers

CVE-2026-50127
GHSA-vmfc-9982-2m45
PYSEC-2026-3416

Timeline

2026-06-01: disclosed
2026-06-10: advisory: NVD publication date
2026-07-07: patched: GitHub Advisory updated/published with patch details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.