Log in Start free

Vulnerability · Published Sep 22, 2026 · Assigned by GitHub_M

CVE-2026-62364wlc may disclose API tokens to project-configured URLs

Low 2.3

In plain English

A low-severity information exposure in wlc from WeblateOrg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.3Low
Exploit odds (30 days)<0.1%top 99.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLC_KEY or --key without a matching WLC_URL or --url. When wlc runs in an untrusted repository, pull request checkout, or directory with untrusted ancestor configuration, it can send the token to an attacker-controlled project-configured URL. URL-scoped keys in [keys] are not affected. This issue is fixed in version 2.0.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12wlcno fix listedDEBIAN-CVE-2026-62364
Debian:13wlcno fix listedDEBIAN-CVE-2026-62364
Debian:14wlc2.2.1-1DEBIAN-CVE-2026-62364
PyPIwlc2.0.1PYSEC-2026-4180
PyPIwlc2.0.1GHSA-3mqq-hv9c-85hc
Ubuntu:26.04:LTSwlcno fix listedUBUNTU-CVE-2026-62364
Ubuntu:26.10wlcno fix listedUBUNTU-CVE-2026-62364

Affected products (as reported)

VendorProductVersions
WeblateOrg wlc < 2.0.1

Weakness: CWE-200, CWE-349 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

References