CVE-2026-22250: SSL Bypass in Weblate CLI

This vulnerability allows an attacker to bypass SSL verification when Weblate CLI connects to remote servers. By crafting malicious URLs, an attacker can potentially intercept or manipulate data transmitted between the CLI and the server, leading to man-in-the-middle attacks or unauthorized access. The impact is limited to connections where the attacker can control the URL used by the CLI, and the severity is considered LOW due to the specific conditions required for exploitation.

1. Reserved2026-01-07
2. Published2026-01-12
3. Modified2026-02-03
4. EPSS updated2026-03-23

The primary mitigation is to upgrade Weblate CLI to version 1.17.0 or later, which includes the fix for this vulnerability. As a temporary workaround, avoid using untrusted Weblate CLI configurations, particularly those where the URL is derived from external sources. Regularly review and audit your Weblate CLI configurations to ensure they adhere to secure practices. There are no specific WAF or proxy rules that can directly address this vulnerability, as it lies within the CLI's internal SSL verification logic.