CVE-2026-50127: Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-10 · updated 2026-10-26
Weakness: CWE-918

Description

Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. This issue has been patched in version 2026.6.

Affected products

WeblateOrg weblate: from 5.15, < 2026.6

References

https://github.com/WeblateOrg/weblate/pull/19768
https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.6
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vmfc-9982-2m45

Get alerted when CVE-2026-50127 or the next vulnerability affects your stack