Weblate CVE-2026-50127

The primary exploitation path (NAT64 bypass) requires that the Weblate host operates on a network with NAT64 translation configured at the kernel level, routing 64:ff9b::/96 traffic to the embedded IPv4 endpoint; this is common in IPv6-only cloud VPCs (AWS, GCP) but not in traditional dual-stack or IPv4-only deployments. The 6to4 bypass path (2002::/16) similarly depends on 6to4 gateway availability in the network path. The multicast, ORCHIDv2, and 6to4 relay anycast bypasses do not require special host configuration but typically do not route to exploitable internal services. The attacker must be able to submit a URL to Weblate that triggers an outbound DNS resolution and HTTP/Git connection - for example, via the component repository URL field, webhook configuration, or any Weblate feature that fetches from user-supplied URLs. VCS_RESTRICT_PRIVATE must be the operative SSRF control (i.e., no independent network-layer egress filtering is in place). Exploitation is limited by the need for attacker-controlled DNS responses returning transition-encoded addresses and by the network topology of the target host.

CVSS 5.9 with AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N reflects genuinely elevated but operationally constrained risk. The High attack complexity (AC:H) is well-justified: the most impactful attack path (NAT64 bypass to IMDS) requires that the Weblate host operates in a NAT64-configured network environment, typical of IPv6-only or dual-stack cloud VPCs but not universal. The unchanged scope (S:U) means the vulnerability does not directly compromise adjacent systems, though SSRF to IMDS can yield cloud IAM credentials leading to broader compromise. Confidentiality impact is High because internal service responses - including credential material from AWS/GCP/Azure metadata services - can be exfiltrated. There is no integrity or availability impact. No CISA KEV listing and no public POC have been identified, making widespread opportunistic exploitation unlikely at time of analysis. EPSS data was not provided in the input, so exploitation probability cannot be quantified beyond CVSS signals. The vendor's PR:N assessment may overstate exposure for deployments where repository URL configuration requires authentication - defenders should verify which Weblate features accessible to unauthenticated users trigger outbound VCS requests in their specific deployment.

An attacker with access to Weblate's repository URL configuration submits a Git repository URL whose hostname is controlled by the attacker and whose DNS AAAA record returns 64:ff9b::a9fe:a9fe (the NAT64 encoding of 169.254.169.254, the AWS IMDS endpoint). Weblate's outbound validator passes the address because Python's ipaddress classifies 64:ff9b::/96 as globally routable, but the host kernel - with NAT64 configured - routes the TCP connection to 169.254.169.254. The Weblate server receives the IMDS response containing IAM role credentials, which the attacker retrieves through Weblate's error output or a covert timing channel. No public proof-of-concept has been identified at time of analysis.