Weblate wlc Security Update Addresses 1 Vulnerability
Tech GuruQuick Answer
Weblate wlc before 2.0.1 can send an unscoped API token to a URL chosen by project configuration. A malicious repository or ancestor directory can supply that configuration. Update to 2.0.1 and pair credentials with an explicit trusted URL, or use the supported URL-scoped key configuration.
Confirm Scope And Apply The Supported Fix
What to do now: Update developer and CI installations, identify jobs that run wlc in untrusted checkouts, and review how each job binds its API key to the intended Weblate service.
Last verified: 2026-09-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Weblate wlc packages and release streams identified in the project advisories |
|---|---|
| Advisory | GHSA-3mqq-hv9c-85hc |
| CVE | CVE-2026-62364 |
| Project advisory publication | 2026-06-26 11:33:36 UTC |
| Recorded source timestamp (historical snapshot) | 2026-09-22 20:34:09 UTC |
| Affected versions | wlc < 2.0.1 |
| Fixed version | wlc 2.0.1 |
| CVSS base score | 2.3 (CVSS v3) |
| CVSS severity | Low |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Files named .weblate, .weblate.ini or weblate.ini can set the API URL. Before the fix, an unscoped WLC_KEY or --key can be sent to that destination. In 2.0.1, WLC_KEY requires WLC_URL, and --key requires --url; URL-scoped keys in the [keys] configuration remain supported.
What To Validate Now
- Inventory. Locate Weblate wlc packages and release streams identified in the project advisories deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: wlc < 2.0.1 Do not infer applicability from product family or severity alone.
- Remediate. Apply wlc 2.0.1 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Use a disposable test token and an endpoint you control to check the intended URL binding and rejection of an unscoped key without an explicit URL. Verify CI jobs still authenticate to the correct service without printing real keys in logs.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Until all installations are updated, pin the trusted API URL or use URL-scoped keys and avoid exposing secrets to untrusted repository configuration. Review potentially misdirected tokens for revocation or rotation; updating wlc does not invalidate a token already disclosed.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
