CVE-2026-50127: Weblate SSRF via private range restriction bypass in VCS_RESTRICT_PRIVATE

Executive brief

Weblate, a popular web-based translation tool, contains a security flaw in how it restricts network requests to private internal addresses. An attacker could potentially bypass these restrictions to access sensitive internal services or data that should not be reachable from the translation platform. This could lead to the exposure of internal infrastructure details or unauthorized access to private corporate resources.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Weblate due to incomplete IP address filtering in the VCS_RESTRICT_PRIVATE setting. The outbound URL guard fails to properly account for transitional IPv6 ranges, multicast addresses, and specific semi-private IPv4 ranges. A remote attacker can exploit this by providing a crafted URL that bypasses private range restrictions, allowing the server to make requests to internal network resources. The vulnerability is tracked as CVE-2026-50127 and has been addressed in version 2026.6.

Affected products

• WeblateOrg weblate >= 5.15, < 2026.6

Timeline

• 2026-06-01: disclosed
• 2026-06-10: advisory: NVD publication date
• 2026-07-07: patched: GitHub Advisory updated/published with patch details

References

• https://api.github.com/users/tonghuaroot
• https://github.com/tonghuaroot
• https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D
• https://api.github.com/users/tonghuaroot/repos
• https://avatars.githubusercontent.com/u/23011166?v=4
• https://api.github.com/users/tonghuaroot/events%7B/privacy%7D