2.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22250

CVE-2026-22250: wlc can skip SSL verification

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22250

CVE-2026-22250:

2.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wlc	pip	< 1.17.0	1.17.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the _should_verify_ssl method within the Weblate class, located in wlc/__init__.py. The flawed logic incorrectly used startswith('127.0.0.1') on the URL's netloc to determine if a connection was local, thereby disabling SSL verification. This could be exploited by a malicious actor using a domain name such as 127.0.0.1.malicious.com. The wlc client would mistakenly treat this as a local connection and skip SSL certificate validation, making it vulnerable to Man-in-the-Middle (MitM) attacks. The invoke_request method is also implicated as it uses the output of _should_verify_ssl to configure its request security. The patch rectifies this by implementing a strict check against a predefined set of localhost addresses ({"127.0.0.1", "localhost", "::1", "[::1]"}). Consequently, both Weblate._should_verify_ssl and Weblate.invoke_request are the key functions that would be observed in a runtime profile during an exploit.

Vulnerable functions

Weblate._should_verify_ssl

wlc/__init__.py

The function `_should_verify_ssl` in the `Weblate` class incorrectly checks if a URL's netloc starts with '127.0.0.1' to determine if it's a localhost connection. This allows a crafted URL with a domain like '127.0.0.1.example.com' to be treated as a localhost connection, causing SSL certificate verification to be skipped.

Weblate.invoke_request

wlc/__init__.py

This function calls the vulnerable `_should_verify_ssl` function to decide whether to perform SSL verification for a request. An attacker can exploit the flaw in `_should_verify_ssl` to make `invoke_request` connect to a malicious server without verifying its SSL certificate.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.