CVE-2026-77573— Weblate: DNS rebinding in VCS operations allows server-side request forgery
Quick assessment
Affected
WeblateOrg weblate
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WeblateOrg weblate是WeblateOrg组织的一款消息队列中间件。 WeblateOrg weblate 2026.8之前版本存在安全漏洞，该漏洞源于VCS操作期间存在DNS重新绑定问题，攻击者可通过克隆、获取、推送等远程操作对内部服务执行服务端请求伪造，可能暴露私有仓库内容。
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-MiddleAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| WeblateOrg | weblate | < 2026.8 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77573
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Weblate: DNS rebinding in VCS operations allows server-side request forgery
Source: CVE Program / CVE List V5
Vulnerability Description
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate validates the hostname's first DNS resolution, but the external VCS clients that later connect perform a separate DNS lookup, so an attacker-controlled hostname that initially resolves to a public address can be re-pointed to an internal or private address before the connection is made. By triggering a clone, fetch, push, or similar remote operation, the attacker can cause Weblate to reach internal VCS-compatible services and potentially expose private repository contents. Installations that permit untrusted repository hostnames while using VCS_RESTRICT_PRIVATE=True are affected. This issue is fixed in version 2026.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5
Vulnerability Title
WeblateOrg weblate 竞争条件问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WeblateOrg weblate是WeblateOrg组织的一款消息队列中间件。 WeblateOrg weblate 2026.8之前版本存在安全漏洞，该漏洞源于VCS操作期间存在DNS重新绑定问题，攻击者可通过克隆、获取、推送等远程操作对内部服务执行服务端请求伪造，可能暴露私有仓库内容。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WeblateOrg | weblate | < 2026.8 | - |
|
II. Public POCs for CVE-2026-77573
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77573
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-77573 (1)
Same Patch Batch · WeblateOrg · 2026-08-26 · 9 CVEs total
| CVE-2026-55228 | 8.1 HIGH | Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorize |
| CVE-2026-61792 | 7.7 HIGH | Weblate path traversal allows a project administrator to read arbitrary files via App stor |
| CVE-2026-62326 | 6.5 MEDIUM | Weblate Has Uncontrolled Resource Consumption via |
| CVE-2026-77507 | 5.3 MEDIUM | Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users |
| CVE-2026-61790 | 4.4 MEDIUM | Weblate: Team-enforced 2FA is bypassed for global permissions |
| CVE-2026-62249 | 4.3 MEDIUM | Weblate: Restricted-component change history leaked to non-member project users through th |
| CVE-2026-55227 | 4.3 MEDIUM | Observable object existence disclosure in private Weblate projects via globally scoped obj |
| CVE-2026-77508 | 3.5 LOW | Weblate: Unverified REST API email changes |
IV. Related Vulnerabilities
Same product: weblate
-
CVE-2026-86035
Weblate: Mercurial argument injection via repository filenam -
CVE-2026-77507
Weblate: Object-scoped RSS feeds disclose private change his -
CVE-2026-62326
Weblate Has Uncontrolled Resource Consumption via -
CVE-2026-62249
Weblate: Restricted-component change history leaked to non-m -
CVE-2026-61792
Weblate path traversal allows a project administrator to rea
Same vendor: WeblateOrg
-
CVE-2026-86035
Weblate: Mercurial argument injection via repository filenam -
CVE-2026-62364
wlc may disclose API tokens to project-configured URLs -
CVE-2026-77507
Weblate: Object-scoped RSS feeds disclose private change his -
CVE-2026-62326
Weblate Has Uncontrolled Resource Consumption via -
CVE-2026-62249
Weblate: Restricted-component change history leaked to non-m
Same weakness: CWE-367
-
CVE-2026-108698
hyper-mcp through 0.8.3 OCI Plugin Signature Verification TO -
CVE-2026-108741
Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Ch -
CVE-2026-73179
Apache CXF: JPA authorization-code consume is non-atomic -
CVE-2026-106451
yawkat LZ4 Java: Native library extraction to a shared tempo -
CVE-2026-89430
Gitea push mirror SSRF and forced writes to internal Git hos
V. Comments for CVE-2026-77573
No comments yet