4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-39845

CVE-2026-39845: Weblate: SSRF via the webhook add-on using unprotected fetch_url()

Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-39845

CVE-2026-39845:

4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
weblate	pip	< 5.17	5.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the Weblate webhook add-on. The analysis of the provided patch reveals that the root cause was the use of an unprotected fetch_url() function when sending webhook notifications. The patch addresses this by replacing fetch_url with fetch_validated_url within the weblate.addons.webhooks.WebhookBase.send_message function. This change introduces necessary security checks to prevent requests to internal or non-public IP addresses.

The vulnerable function is WebhookBase.send_message because it is the exact location in the code where the outbound HTTP request is made using the user-provided webhook URL. During an exploit, this function would be present in the stack trace as it executes the malicious request. The patch also adds validation at the form level (BaseWebhooksAddonForm.clean_webhook_url) to prevent saving malicious URLs, but the actual SSRF is triggered within send_message.

Vulnerable functions

WebhookBase.send_message

weblate/addons/webhooks.py

The `send_message` function in the `WebhookBase` class was responsible for dispatching webhooks. It previously used the `fetch_url` function, which did not perform any validation on the provided URL. This allowed an attacker to configure a webhook with a URL pointing to an internal or private network resource. When the webhook was triggered, the application would make a request to this internal resource, resulting in a Server-Side Request Forgery (SSRF) vulnerability. The patch replaces the call to `fetch_url` with `fetch_validated_url`, which enforces restrictions on the target URL, mitigating the SSRF risk.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.