6.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24126

CVE-2026-24126: Weblate has an argument injection in management console

Impact

The SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to ssh-add.

Patches

https://github.com/WeblateOrg/weblate/pull/17722

Workarounds

Properly limit access to the management console.

References

This issue was reported to us by alexb_616 via HackerOne.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24126

CVE-2026-24126:

6.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Weblate	pip	< 5.16.0	5.16.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an argument injection flaw in Weblate's SSH management console, identified as CVE-2026-24126. The root cause is the lack of input validation on the hostname provided when adding a new SSH host key. An attacker with administrative access could provide a crafted hostname (e.g., starting with a hyphen like -oProxyCommand=...) to inject malicious arguments into the ssh-keyscan command executed by the server.

The primary entry point is the weblate.wladmin.views.ssh view, which handles the form submission from the management interface. The user-supplied host was passed through the SSHAddForm without proper validation. This unvalidated input was then passed to the weblate.vcs.ssh.add_host_key function, which constructs and executes the ssh-keyscan command, leading to command injection.

A secondary, related vector existed in the weblate.trans.models.component.Component.add_ssh_host_key method, which could also call add_host_key with an unvalidated hostname extracted from a repository URL.

The patch addresses this vulnerability by introducing strict hostname validation using a DomainOrIPValidator in two places: directly in the SSHAddForm for the management console and within a new extract_url_host_port utility function used when parsing repository URLs.

Vulnerable functions

weblate.vcs.ssh.add_host_key

weblate/vcs/ssh.py

This function takes a `host` parameter and uses it directly in a `subprocess.run` call to `ssh-keyscan`. Prior to the patch, this input was not sanitized, allowing an attacker to inject arguments into the command. The fix was to add validation in the calling functions rather than in this function itself, but this is where the unvalidated input is used to execute a command.

weblate.wladmin.views.ssh

weblate/wladmin/views.py

This view function is the entry point for the vulnerability from the Weblate management console. It processes the 'add-host' action, taking user input from `SSHAddForm`. Before the patch, the form did not validate the 'host' field for malicious characters, and the view passed this tainted data to the `add_host_key` function.

weblate.trans.models.component.Component.add_ssh_host_key

weblate/trans/models/component.py

This method provides another pathway to the argument injection vulnerability. It extracts a hostname from a component's repository URL and passes it to the `add_host_key` function. Before the patch, the parsing and extraction logic did not validate the hostname, allowing a maliciously crafted repository URL to trigger the vulnerability. The patch replaces this logic with a call to the new `extract_url_host_port` function, which includes proper validation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-24126: Weblate has an argument injection in management console

Impact

Patches

Workarounds

References

CVE-2026-24126:

6.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

6.6

6.6

CVE-2026-24126: Weblate has an argument injection in management console

Impact

Patches

Workarounds

References

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI