CVE-2026-22251: wlc may leak API keys due to an insecure API key configuration

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-12 · updated 2026-06-17
Weakness: CWE-200

Description

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.

Affected products

WeblateOrg wlc: before 1.17.0 — fixed in 1.17.0

How to fix

Upgrade to a fixed version: WeblateOrg wlc 1.17.0. Check the vendor advisory for mitigations.

References

https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797
https://github.com/WeblateOrg/wlc/pull/1098
https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766

Get alerted when CVE-2026-22251 or the next vulnerability affects your stack