Weblate EUVD-2026-66721

Exploitation requires an authenticated Weblate account with the specific permission to manage VCS component repository URLs - not granted to ordinary translator accounts, only to component or project managers. The Weblate deployment must have VCS_RESTRICT_PRIVATE=True configured; installations without this setting do not use the control that is bypassed. The attacker must control a domain's authoritative DNS and have the ability to change its A record with a very short TTL, requiring timing coordination between the DNS record flip and the triggered VCS operation. This limits exploitation to attackers with DNS infrastructure control, not casual opportunistic actors. Impact is bounded to confidentiality (C:L): internal VCS-compatible service responses may be partially exposed; there is no confirmed integrity or availability impact. Post-2026.8 partial mitigation: for Git HTTPS and SSH, address pinning closes the rebinding window without configuration changes; Mercurial and Subversion backends remain restricted unless explicitly allowlisted, representing a breaking change for those backend users.

The CVSS base score of 3.5 (Low) accurately reflects the constrained exploitation conditions: AC:H captures the DNS rebinding timing requirement, which demands attacker control of authoritative DNS and a precisely timed record swap; PR:L confirms the need for an authenticated account with a specific elevated permission; and C:L reflects that data exposure is limited to partial VCS protocol response content from reached internal services. The scope change (S:C) is the most significant signal - it indicates the attacker can pivot to internal infrastructure beyond Weblate's perimeter. EPSS score was not included in the provided intelligence data, so exploitation probability cannot be quantified. No KEV listing exists and no public exploit has been identified, consistent with the low CVSS score and high attack complexity. SSVC signals reinforce low urgency: exploitation is not automatable at scale (AC:H, PR:L), and the required VCS_RESTRICT_PRIVATE=True deployment condition is non-default in open-source self-hosted instances. Notably, this vulnerability only manifests when an operator has already attempted to harden the deployment via VCS_RESTRICT_PRIVATE - installations without that setting are not targeted by this bypass. The realistic threat actor is an insider or a compromised privileged account, not an anonymous external attacker.

An attacker holding a Weblate account with VCS URL management permissions registers a domain with a TTL of one second, initially resolving it to a public IP to pass Weblate's VCS_RESTRICT_PRIVATE hostname check. After validation succeeds, they change the DNS record to point to an internal service - such as an internal Gitea instance or the cloud metadata endpoint - and immediately trigger a VCS fetch or clone operation. The external VCS client re-resolves the hostname, reaches the internal target, and VCS protocol responses or error messages containing internal data are surfaced through Weblate. No public exploit code has been identified at time of analysis, though DNS rebinding toolkits are publicly available.