CVE-2026-50127 MEDIUM

CVE-2026-50127: Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)

Vendor Weblateorg
Product weblate
Weakness CWE-918 · SSRF
Published June 10, 2026
Last update June 11, 2026
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. This issue has been patched in version 2026.6.

Key dates

02Disclosure timeline

June 10, 2026 CVE published
June 11, 2026 Record updated