CVE-2026-62364: wlc may disclose API tokens to project-configured URLs

September 22, 2026

wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration.

If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLC_KEY or --key without also pinning the URL, wlc would send the token to the project-configured URL.

Impacted users are those running wlc in untrusted repositories, pull request checkouts, or directories with untrusted ancestor configuration while using WLC_KEY or --key.

References

github.com/WeblateOrg/wlc/commit/15cbdfc5b2c6183ef6864ea758091643a0ce6c89
github.com/WeblateOrg/wlc/pull/1500
github.com/WeblateOrg/wlc/releases/tag/2.0.1
github.com/WeblateOrg/wlc/security/advisories/GHSA-3mqq-hv9c-85hc
github.com/advisories/GHSA-3mqq-hv9c-85hc
nvd.nist.gov/vuln/detail/CVE-2026-62364

Code Behaviors & Features

Detect and mitigate CVE-2026-62364 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →