Weblate command-line client susceptible to SSL verification skip

The core of this vulnerability lies in the improper handling of SSL verification within the Weblate CLI. An attacker can craft malicious URLs that bypass the standard SSL certificate validation process. This allows them to connect to servers using self-signed certificates or certificates from untrusted Certificate Authorities without proper verification. While the CVSS score is LOW, the potential impact is significant if the attacker can leverage this to intercept sensitive data transmitted over the connection or impersonate legitimate users. This could lead to unauthorized access and data breaches, particularly in environments where Weblate CLI is used to manage translations or other sensitive content.

Organizations and individuals using Weblate CLI for automated translation workflows, particularly those relying on external or untrusted URL sources for connection configuration, are at risk. Legacy Weblate CLI installations running versions prior to 1.17.0 are also vulnerable.

• python / cli: Inspect Weblate CLI configuration files for suspicious URLs or connections to untrusted hosts. • python / cli: Monitor Weblate CLI logs for SSL verification errors or unusual connection attempts. • generic web: Check for unusual network traffic patterns originating from Weblate CLI processes.

1. 2026-01-12Disclosure

   disclosure

1. Reserviert2026-01-07
2. Veröffentlicht2026-01-12
3. Geändert2026-02-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-22250 is to upgrade Weblate CLI to version 1.17.0 or later, which includes the fix for the SSL verification bypass. If upgrading is not immediately feasible, a temporary workaround is to strictly avoid using untrusted Weblate CLI configurations. This means carefully reviewing and validating any custom configurations or URLs used by the CLI. Consider implementing network-level controls, such as a proxy or WAF, to inspect and filter traffic to and from the Weblate CLI, although this is not a direct mitigation. After upgrading, confirm the fix by attempting to connect to a server with a self-signed certificate and verifying that the connection fails with an appropriate SSL verification error.