CVE-2026-22251: Weblate CLI API Key Leak Vulnerability

CVE-2026-22251 Overview

CVE-2026-22251 is an Information Leakage vulnerability in wlc, the Weblate command-line client that uses Weblate's REST API. Prior to version 1.17.0, wlc supported providing unscoped API keys in its settings. While this practice was discouraged for years, the underlying code was never removed from the codebase. This legacy functionality creates a security risk where API keys may be inadvertently leaked to different servers, potentially exposing sensitive authentication credentials to unauthorized parties.

Critical Impact

Unscoped API keys configured in wlc may be transmitted to unintended servers, potentially allowing attackers to capture and abuse these credentials to access Weblate translation services or perform unauthorized actions.

Affected Products

• wlc (Weblate Command-Line Client) versions prior to 1.17.0

Discovery Timeline

• 2026-01-12 - CVE CVE-2026-22251 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-22251

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue stems from legacy code that allowed users to configure unscoped API keys within the wlc client settings. Unscoped API keys, by their nature, are not restricted to specific endpoints or operations, making them particularly dangerous if leaked.

The vulnerability requires local access to the system where wlc is configured, and exploitation depends on user interaction with the affected configuration. When exploited, the API key could be sent to unintended servers during API operations, enabling potential credential theft. This is particularly concerning in environments where the Weblate CLI client is used across multiple translation service endpoints.

Root Cause

The root cause of this vulnerability is the retention of deprecated code that processed unscoped API keys. Although the use of unscoped keys was discouraged in documentation, the implementation continued to accept and process these keys without proper scoping validation. This created a pathway for API keys to be included in requests to servers that should not receive them, particularly when the client interacted with multiple server configurations or when redirect scenarios occurred.

Attack Vector

The attack vector for CVE-2026-22251 is local with high attack complexity. An attacker would need to either:

1. Gain local access to a system where wlc is installed and configured with an unscoped API key
2. Create a scenario where the victim's wlc client communicates with a malicious or unintended server endpoint
3. Intercept the leaked API key from network traffic or server logs

The vulnerability could be exploited in scenarios where users have configured multiple Weblate server endpoints, or where DNS or network manipulation causes the client to contact unintended servers while still transmitting the unscoped API credentials.

The fix implemented in the security patch removes support for unscoped API keys entirely, enforcing the use of properly scoped credentials that are bound to specific server endpoints. For technical details on the implementation, see the GitHub Security Advisory.

Detection Methods for CVE-2026-22251

Indicators of Compromise

• Presence of unscoped API keys in wlc configuration files (typically .weblate or weblate.ini)
• Unexpected API requests from wlc to servers other than the configured Weblate instance
• Authentication attempts to Weblate services from unauthorized IP addresses using legitimate API keys

Detection Strategies

• Review wlc configuration files for any API key entries that do not specify a server scope
• Monitor outbound network connections from systems running wlc for unexpected destination servers
• Enable API access logging on Weblate servers to detect usage of potentially compromised keys from unusual sources

Monitoring Recommendations

• Implement network monitoring to track wlc client communications and identify connections to unexpected endpoints
• Configure alerting for API key usage from geographic regions or IP ranges outside normal operational boundaries
• Regularly audit wlc configurations across development and translation teams to ensure compliance with scoped API key requirements

How to Mitigate CVE-2026-22251

Immediate Actions Required

• Upgrade wlc to version 1.17.0 or later immediately
• Review all existing wlc configurations and replace any unscoped API keys with properly scoped credentials
• Rotate any API keys that may have been configured without proper scoping, as they should be considered potentially compromised
• Audit Weblate server logs for any suspicious API access patterns

Patch Information

The vulnerability has been addressed in wlc version 1.17.0. The fix removes support for unscoped API keys, ensuring that all API credentials must be properly scoped to specific server endpoints. The security patch can be reviewed in the GitHub Commit Update and the associated GitHub Pull Request #1098.

Workarounds

• If immediate upgrade is not possible, manually edit wlc configuration files to ensure all API keys are scoped to their intended server endpoints
• Remove any unscoped API key configurations and regenerate scoped keys through the Weblate web interface
• Implement network-level controls to restrict wlc client communications to known Weblate server IP addresses only

# Configuration example - Upgrade wlc to patched version
pip install --upgrade wlc>=1.17.0

# Verify installed version
wlc --version