Executive brief
Weblate wlc is a command-line tool for managing translations on Weblate servers. When run in directories containing attacker-controlled configuration files, it could accidentally send API authentication tokens to unintended servers, exposing credentials. This risk primarily affects users who run wlc in untrusted code repositories or pull request checkouts.
Technical details
The vulnerability is a credential exposure issue (CWE-200, CWE-349) in wlc's configuration handling. When an unscoped API token is supplied via WLC_KEY environment variable or --key flag without an explicit URL, wlc automatically discovers and uses the API URL from project configuration files (.weblate, .weblate.ini, or weblate.ini). An attacker who controls these configuration files in a shared repository can redirect the token to their own server. The attack requires the user to be running wlc with secrets in untrusted checkouts. The fix, released in wlc 2.0.1, enforces that WLC_KEY and --key require explicit URL specification (WLC_URL or --url), while preserving support for URL-scoped keys in configuration file sections.
Affected products
- Weblate wlc < 2.0.1
Timeline
- 2026-06-26: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-06-26: patched: Fix released in wlc 2.0.1
- 2026-09-22: advisory: Advisory updated on GitHub with CVE-2026-62364