CVE-2026-22251
Medium · 5.3Weblate wlc has insecure API key configuration
CVSS
5.3
EPSS
0.2%
Published
Jan 12, 2026
CISA due date
—
The record
Historically, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be used against different server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | wlc | 0 | 1.17.0 |
Related vulnerabilities
- GHSA-9rp8-h4g8-8766 Weblate wlc has insecure API key configuration Same vulnerability
- CVE-2026-23535 wlc is a Weblate command-line client using Weblate's REST API. Also affects wlc
- GHSA-mmwx-79f6-67jg Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command Also affects wlc
- GHSA-2mmv-7rrp-g8xh Weblate command-line client susceptible to SSL verification skip Also affects wlc
- CVE-2026-22250 Weblate command-line client susceptible to SSL verification skip Also affects wlc
- CVE-2026-87951 Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service… CWE-922
- CVE-2026-44629 Improper access control to the Synergis Softwire installation folder. CWE-922
- CVE-2026-20705 Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R)… CWE-922