EUVD-2026-66721Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
DNS rebinding requires controlled DNS infrastructure and precise timing (AC:H); VCS URL management is an elevated non-admin role (PR:L); scope change reflects internal network pivot; no integrity or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate validates the hostname's first DNS resolution, but the external VCS clients that later connect perform a separate DNS lookup, so an attacker-controlled hostname that initially resolves to a public address can be re-pointed to an internal or private address before the connection is made. By triggering a clone, fetch, push, or similar remote operation, the attacker can cause Weblate to reach internal VCS-compatible services and potentially expose private repository contents. Installations that permit untrusted repository hostnames while using VCS_RESTRICT_PRIVATE=True are affected. This issue is fixed in version 2026.8.
AnalysisAI
DNS rebinding SSRF in Weblate prior to version 2026.8 allows an authenticated user with VCS component URL management privileges to circumvent VCS_RESTRICT_PRIVATE protections and reach internal network services. The attack exploits the time gap between Weblate's initial hostname validation and the VCS client's subsequent independent DNS lookup - an attacker-controlled domain passes validation pointing to a public IP, then switches to an internal address before the actual VCS connection is made. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Weblate account with the specific permission to manage VCS component repository URLs - not granted to ordinary translator accounts, only to component or project managers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 3.5 (Low) accurately reflects the constrained exploitation conditions: AC:H captures the DNS rebinding timing requirement, which demands attacker control of authoritative DNS and a precisely timed record swap; PR:L confirms the need for an authenticated account with a specific elevated permission; and C:L reflects that data exposure is limited to partial VCS protocol response content from reached internal services. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a Weblate account with VCS URL management permissions registers a domain with a TTL of one second, initially resolving it to a public IP to pass Weblate's VCS_RESTRICT_PRIVATE hostname check. After validation succeeds, they change the DNS record to point to an internal service - such as an internal Gitea instance or the cloud metadata endpoint - and immediately trigger a VCS fetch or clone operation. … |
| Remediation | Vendor-released patch: Weblate 2026.8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter o
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive f
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allow
We need to produce a JSON object for CVE-2026-33435 based on all provided intelligence. The user gave description, CVSS,
Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive fil
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 202
Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation
Weblate versions up to 5.16.0 contains a vulnerability that allows attackers to an argument injection to `ssh-add` (CVSS
Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'E
Weblate is a web based localization tool. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable. Pub
Share
External POC / Exploit Code
Leaving vuln.today