CVE-2026-77573

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.8

Description A user with permissions to manage component repository URLs can execute server-side request forgery (SSRF) against internal services via DNS rebinding during Version Control System (VCS) operations. This occurs because the software validates the hostname during the first DNS resolution, but subsequent connections by external VCS clients trigger a separate lookup. An attacker can use a hostname that initially resolves to a public address and then re-point it to an internal or private address. By initiating operations such as clone, fetch, or push, the attacker can force the system to access internal VCS-compatible services, potentially exposing private repository contents. This issue affects installations that allow untrusted repository hostnames while the VCS RESTRICT PRIVATE variable is set to True.

Recommendations Update to version 2026.8. Restrict the use of untrusted repository hostnames when VCS RESTRICT PRIVATE is enabled.