CVE-2026-22251 Details
Description
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.
A vulnerability exists in the Weblate command-line client, WLC, prior to version 1.17.0, allowing unscoped API keys to be loaded from configuration files. This could lead to the accidental leakage of API keys to different servers. Although this practice was discouraged for years, the functionality remained in place, creating a potential security risk.
Users should update to WLC version 1.17.0 or later, and remove any unscoped API keys from their configuration. Only URL-scoped keys should be used in the '[keys]' section.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| weblate wlc | < 1.17.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 27, 2026 | Initial Analysis | [email protected] |
| Jan 12, 2026 | New CVE Received | [email protected] |