CVE-2026-22250

Trust Issues: The 127.0.0.1 Prefix Bypass in Weblate CLI

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 12, 2026·5 min read·3 visits

Executive Summary (TL;DR)

The Weblate CLI disabled SSL verification for any URL starting with '127.0.0.1'. Attackers registered domains like '127.0.0.1.attacker.com' to trick the client into trusting their malicious servers, exposing API tokens and translation data.

A critical logic flaw in the Weblate command-line client (wlc) allowed attackers to bypass SSL/TLS verification by crafting URLs that mimic local loopback addresses. By exploiting a naive string prefix check and case-sensitive protocol validation, malicious actors could perform Man-in-the-Middle (MitM) attacks against developers pushing translation updates.

Fix Analysis (1)

Technical Appendix

CVSS Score
7.5/ 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected Systems

Weblate Command-Line Client (wlc)CI/CD pipelines using wlcDeveloper workstations with wlc installed

Affected Versions Detail

Product
Affected Versions
Fixed Version
wlc
WeblateOrg
< 2026-01-07 (Commit a513864)Jan 2026 Release
AttributeDetail
CVE IDCVE-2026-22250
CVSS v3.17.5 (High)
CWECWE-295 (Improper Certificate Validation)
VectorAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack VectorMan-in-the-Middle (MitM)
Affected Componentwlc/__init__.py (_should_verify_ssl)
CWE-295
Improper Certificate Validation

The software does not validate, or incorrectly validates, a certificate. This allows an attacker to spoof a trusted entity by presenting a certificate that the application accepts.

Vulnerability Timeline

Vulnerability identified and patch authored by Michal Čihař
2026-01-07
Pull Request #1097 opened
2026-01-07
CVE-2026-22250 Assigned
2026-01-10

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.