Weblate CVE-2026-34244

Exploitation requires that the attacker holds the per-project 'Administration' role in Weblate, which grants the project.edit permission - this is not the global superuser but a project-scoped delegated role. The machine translation feature must be available and not restricted via WEBLATE_MACHINERY to a static list of backends that disallow custom URLs. The vulnerability fires during configuration validation (save/test of a new machine translation service), so the attacker needs access to the project settings UI or the corresponding REST API endpoint (api:project-machinery-settings). What limits exploitation: the information returned is capped at 200 characters of the HTTP response body; the attacker cannot control request method/headers beyond what Weblate's validation code sends; write or code-execution impact requires chaining with additional vulnerabilities. If WEBLATE_MACHINERY is set to a closed list of standard service classes that do not accept user-supplied endpoint URLs, the attack surface is eliminated even on unpatched versions.

The real-world risk of CVE-2026-34244 is moderate and well-captured by the NVD CVSS score of 5.0, which is materially lower than many SSRF findings due to the combination of required low-privilege authentication and limited information disclosure (200-character response fragments only). EPSS at 0.03% (7th percentile) and SSVC designation of 'exploitation: none / automatable: no / technical impact: partial' reinforce that mass exploitation is not a realistic near-term concern. Even a mid-sized municipal IT team in sopot running an on-premises Weblate instance should treat this as a medium-priority upgrade rather than an emergency response item, provided that project Administration roles are not freely delegated to untrusted users. The scope-changed (S:C) vector metric accurately reflects that the SSRF crosses a trust boundary from the web application to the internal network, but the practical damage is constrained by the 200-character response cap and the PR:L requirement - an outside attacker first needs a foothold as a project administrator. KEV status is absent and no POC has been published. The primary risk is internal network reconnaissance: an attacker with the administration role could enumerate open ports, read metadata endpoints (e.g., cloud IMDS), or identify internal service banners, but cannot write data or achieve code execution through this vector alone.

A Weblate project administrator - either a legitimately privileged user or an attacker who has compromised such an account - navigates to the project's machine translation settings and configures a service URL pointing to an internal address such as http://169.254.169.254/latest/meta-data/ (cloud IMDS) or an internal API endpoint. When they save or validate the configuration, Weblate issues an outbound HTTP GET to that address and returns the first 200 characters of the response body in the validation error, disclosing instance metadata, internal service banners, or other sensitive details to the attacker. No public exploit code exists, and the attack requires prior authenticated access with project-level administration rights.