CVE-2026-24126: Weblate has an argument injection in management console

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-19 · updated 2026-06-17
Weakness: CWE-88

Description

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

Affected products

WeblateOrg weblate: before 5.16 — fixed in 5.16

How to fix

Upgrade to a fixed version: WeblateOrg weblate 5.16. Check the vendor advisory for mitigations.

References

https://github.com/WeblateOrg/weblate/commit/78773cc141ce0a97900c11341e6cf856451395fd
https://github.com/WeblateOrg/weblate/pull/17722
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-33fm-6gp7-4p47

Get alerted when CVE-2026-24126 or the next vulnerability affects your stack