CVE-2026-24126: Weblate Argument Injection Vulnerability

CVE-2026-24126 Overview

Weblate, a popular web-based localization tool, contains a critical argument injection vulnerability in its SSH management console. Prior to version 5.16.0, the SSH management console failed to validate input when adding SSH host keys, allowing attackers to inject malicious arguments to the ssh-add command. This vulnerability enables privileged attackers with access to the management console to potentially execute arbitrary commands on the underlying system.

Critical Impact

Attackers with high-level privileges can exploit improper input validation in the SSH key management functionality to achieve command execution with potential for complete system compromise, including confidentiality, integrity, and availability impacts.

Affected Products

• Weblate versions prior to 5.16.0
• Weblate web-based localization tool with SSH management console enabled

Discovery Timeline

• February 19, 2026 - CVE-2026-24126 published to NVD
• February 19, 2026 - Last updated in NVD database

Technical Details for CVE-2026-24126

Vulnerability Analysis

This vulnerability is classified as CWE-88: Improper Neutralization of Argument Delimiters in a Command (Argument Injection). The flaw exists in how the Weblate SSH management console processes user-supplied input when adding SSH host keys. The application passes untrusted input directly to the ssh-add utility without proper validation or sanitization, enabling argument injection attacks.

The vulnerability requires network access and high-level privileges to exploit, but when successfully exploited, the impact extends beyond the vulnerable component's security scope. This means an attacker could potentially break out of the application context and affect the underlying system or other components, leading to unauthorized access to sensitive data, modification of system files, or denial of service.

Root Cause

The root cause lies in insufficient input validation within the SSH key management functionality. When processing SSH host key additions through the management console, user-supplied parameters were passed directly to the ssh-add command without proper sanitization. The fix introduces the extract_url_host_port function from weblate.vcs.ssh to properly parse and validate URL components before they are used in command execution, preventing malicious argument injection.

Attack Vector

An attacker with administrative or high-privilege access to the Weblate management console can craft malicious input when adding SSH host keys. By injecting specially crafted arguments, the attacker can manipulate the ssh-add command execution to perform unintended operations. The attack is network-based and requires no user interaction, though it does require elevated privileges within the Weblate application.

# Security patch from weblate/trans/models/component.py
# Source: https://github.com/WeblateOrg/weblate/commit/78773cc141ce0a97900c11341e6cf856451395fd

 from weblate.vcs.base import RepositoryError, RepositorySymlinkError
 from weblate.vcs.git import GitMergeRequestBase, LocalRepository
 from weblate.vcs.models import VCS_REGISTRY
-from weblate.vcs.ssh import add_host_key
+from weblate.vcs.ssh import add_host_key, extract_url_host_port

 if TYPE_CHECKING:
     from collections.abc import Iterable

The patch imports the extract_url_host_port function to properly extract and validate host/port information from URLs before passing them to SSH operations, preventing argument injection through malicious URL components.

Detection Methods for CVE-2026-24126

Indicators of Compromise

• Unusual or malformed SSH host key entries in Weblate configuration
• Unexpected ssh-add command executions with non-standard arguments in system logs
• Administrative actions in Weblate management console from unexpected IP addresses or users
• Signs of unauthorized SSH key additions or modifications

Detection Strategies

• Monitor Weblate management console access logs for suspicious administrative activities
• Review system audit logs for anomalous ssh-add command invocations
• Implement alerting on SSH-related configuration changes within Weblate
• Deploy web application firewalls (WAF) with rules to detect argument injection patterns

Monitoring Recommendations

• Enable comprehensive logging for the Weblate management console, particularly SSH-related operations
• Configure SIEM rules to correlate management console access with system-level SSH command execution
• Implement file integrity monitoring on SSH configuration directories
• Monitor for privilege escalation attempts following management console access

How to Mitigate CVE-2026-24126

Immediate Actions Required

• Upgrade Weblate to version 5.16.0 or later immediately
• Review management console access logs for any suspicious SSH key addition activities
• Audit current SSH host key configurations for any unauthorized entries
• Restrict management console access to essential personnel only

Patch Information

Weblate has released version 5.16.0 which addresses this vulnerability. The security fix is available in commit 78773cc141ce0a97900c11341e6cf856451395fd. Organizations should update their Weblate installations immediately. For detailed information, refer to the GitHub Security Advisory GHSA-33fm-6gp7-4p47 and the related pull request.

Workarounds

• Properly limit access to the Weblate management console to trusted administrators only
• Implement network segmentation to restrict management console access to specific IP ranges
• Consider disabling SSH host key management through the web interface if not required
• Deploy additional access controls or multi-factor authentication for administrative functions

# Configuration example - Restrict management console access via web server
# Example for nginx: limit access to management endpoints by IP

location /manage/ {
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
    # Additional authentication layer
    auth_basic "Management Console";
    auth_basic_user_file /etc/nginx/.htpasswd;
}