CVE-2026-22251mediumCWE-200

CVE-2026-22251: medium-severity vulnerability in WeblateOrg wlc

wlc may leak API keys due to an insecure API key configuration

Published

Follow this CVE+ Monitor wlc+ Monitor wlc

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.2%
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected products
WeblateOrg · wlc
Related CVEs — WeblateOrg wlc

In the same product, most dangerous first.

CVE-2026-23535HIGHwlc Path traversal: Unsanitized API slugs in download commandEPSS 0.4%CVE-2026-42150MEDIUMwlc: print_html outputs API data without HTML escaping, enabling stored XSSEPSS 0.2%CVE-2026-22250LOWwlc can skip SSL verificationEPSS 0.2%CVE-2026-62364LOWwlc may disclose API tokens to project-configured URLsEPSS 0.1%