CVE-2026-33440 Overview
CVE-2026-33440 is a Server-Side Request Forgery (SSRF) vulnerability in Weblate, a popular web-based localization and translation management tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting, which is designed to restrict which external domains can be used for downloading assets like screenshots, only validated the initial request URL. It failed to validate any subsequent HTTP redirect targets, allowing attackers to bypass the domain allowlist through redirect chains.
Critical Impact
Authenticated users can bypass domain restrictions by using redirects to access internal or restricted resources, potentially leading to information disclosure from internal systems.
Affected Products
- Weblate versions prior to 5.17
Discovery Timeline
- April 15, 2026 - CVE-2026-33440 published to NVD
- April 15, 2026 - Last updated in NVD database
Technical Details for CVE-2026-33440
Vulnerability Analysis
This vulnerability stems from incomplete input validation in Weblate's asset download functionality. When users upload screenshots or other assets via URL, Weblate downloads the content server-side to store it locally. The ALLOWED_ASSET_DOMAINS configuration setting was intended to restrict which external domains could be used for these downloads. However, the implementation only checked the initial URL against the allowlist, leaving a significant gap in the security control.
An authenticated user could exploit this by providing an allowed initial URL that redirects to an unauthorized target. Since HTTP redirect responses weren't validated against the domain allowlist, the server would follow redirects to any destination, including internal network resources, cloud metadata endpoints, or other restricted services.
Root Cause
The root cause is a CWE-918 (Server-Side Request Forgery) issue where the domain validation logic was applied inconsistently. The allowlist check occurred only once during the initial request phase, without extending validation to cover the complete redirect chain that HTTP clients commonly follow.
Attack Vector
An attacker with low-privilege authenticated access to Weblate can craft a malicious URL pointing to an allowed domain that serves an HTTP redirect (301, 302, 307, or 308) to an internal or otherwise restricted target. The attack scenario proceeds as follows:
- Attacker sets up a redirect on an allowed domain or finds an open redirect on a trusted site
- Attacker provides this URL when uploading a screenshot via URL
- Weblate server validates the initial URL against ALLOWED_ASSET_DOMAINS (passes)
- Server follows the redirect without re-validating the destination
- Server fetches content from the unauthorized destination, potentially exposing internal data
The fix ensures that every redirect target is validated against the ALLOWED_ASSET_DOMAINS allowlist before the server follows it.
Assets are downloaded once by the Weblate server and stored locally, rather than
being served directly from external domains to users.
+The allowlist is applied to the initial URL and to every HTTP redirect target
+before Weblate follows it. Redirects to hosts outside of this allowlist are
+rejected.
+
It expects a list of host/domain names. You can use fully qualified names
(e.g ``www.example.com``) or prepend with a period as a wildcard to match
all subdomains (e.g ``.example.com`` will match ``cdn.example.com`` or ``static.example.com``).
-Defaults to `[*]` which will allow all domains.
+Defaults to ``["*"]``, which allows all domains.
**Example**
Source: GitHub Commit Reference
Detection Methods for CVE-2026-33440
Indicators of Compromise
- Unusual outbound HTTP requests from the Weblate server to internal IP addresses or cloud metadata endpoints (e.g., 169.254.169.254)
- Screenshot upload requests with URLs containing known open redirect patterns
- HTTP redirect chains in server logs leading to unexpected destinations
- Asset download attempts targeting localhost, private IP ranges, or internal hostnames
Detection Strategies
- Monitor Weblate application logs for screenshot URL uploads that result in multiple redirects
- Implement network monitoring to detect SSRF attempts targeting internal services from the Weblate server
- Review web server access logs for redirect patterns that could indicate exploitation attempts
- Deploy web application firewall rules to detect and block common SSRF payloads in URL parameters
Monitoring Recommendations
- Configure alerting for any outbound connections from the Weblate server to internal network ranges
- Enable verbose logging for the asset download functionality to capture full redirect chains
- Monitor for authentication anomalies followed by bulk asset upload attempts
How to Mitigate CVE-2026-33440
Immediate Actions Required
- Upgrade Weblate to version 5.17 or later immediately
- Review ALLOWED_ASSET_DOMAINS configuration and ensure it does not use the default wildcard ["*"]
- Audit recent screenshot uploads for any suspicious URLs or redirect patterns
- Implement network segmentation to limit the Weblate server's access to internal resources
Patch Information
The vulnerability has been addressed in Weblate version 5.17. The fix extends the domain allowlist validation to cover every HTTP redirect target before the server follows it. The patch is available in commit 8be80625a864c8db5854503872a65e8a0b7399a6. For full details, refer to the GitHub Security Advisory GHSA-5fhx-9jwj-867m.
Workarounds
- Configure ALLOWED_ASSET_DOMAINS with an explicit list of trusted domains instead of the wildcard default
- Implement network-level controls to prevent the Weblate server from accessing internal resources
- Disable URL-based screenshot uploads if the feature is not required
# Configuration example - weblate/settings.py
# Restrict asset downloads to specific trusted domains
ALLOWED_ASSET_DOMAINS = [
"cdn.example.com",
".trusted-assets.org",
]
# Avoid using ["*"] which allows all domains
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
