5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50127

CVE-2026-50127: Weblate SSRF: outbound URL guard misses some private ranges

Impact

Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.

Patches

https://github.com/WeblateOrg/weblate/pull/19768

Resources

The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50127

CVE-2026-50127:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
weblate	pip	>= 5.15, < 2026.6	2026.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Weblate's outbound URL validation logic, specifically in how it determines if an IP address is public. The functions _is_public_ip and validate_untrusted_hostname in weblate/utils/outbound.py used the is_global property from Python's ipaddress library. However, this property did not correctly handle various IPv6-to-IPv4 transition mechanisms, such as 6to4, NAT64, and IPv4-compatible addresses. An attacker could craft a hostname that would resolve to an IPv6 address that, while appearing 'global' to the is_global check, would actually route to an internal or private IPv4 address on the server. This allowed for a Server-Side Request Forgery (SSRF) attack, bypassing the intended VCS_RESTRICT_PRIVATE protection. The patch addresses this by introducing a new function, _unwrap_ipv6_transition (later refactored into _is_global_address), which unwraps these transitional addresses to reveal the underlying IPv4 address before performing the public/private check. The vulnerable functions were updated to use this new, more robust validation logic.

Vulnerable functions

_is_public_ip

weblate/utils/outbound.py

The function `_is_public_ip` was vulnerable because it used `address.is_global` to check if an IP address was public without considering IPv6 transition addresses. This allowed an attacker to bypass the check by providing a specially crafted IPv6 address that wrapped a private IPv4 address. The patch replaces the direct call to `is_global` with a call to the new `_is_global_address` function, which correctly handles these transition addresses.

validate_untrusted_hostname

weblate/utils/outbound.py

The function `validate_untrusted_hostname` was vulnerable because it performed an inline check using `ip_address.is_global` on a resolved IP address. This check did not account for IPv6 transition addresses, allowing an attacker to use a hostname that resolves to a crafted IPv6 address to bypass the SSRF protection. The patch replaces this inline check with a call to the new `_is_global_address` function, which properly validates the address.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.