VulnerabilityAnalyzed

CVE-2026-24126

Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`.

CRITICAL 9.1EPSS 0.45%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS: 0.45% probability · 38th percentile
CISA KEV: Not listed
Weakness: CWE-88
Affected: weblate/weblate
Source: security-advisories@github.com

References

https://github.com/WeblateOrg/weblate/commit/78773cc141ce0a97900c11341e6cf856451395fdPatch
https://github.com/WeblateOrg/weblate/pull/17722Issue Tracking
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-33fm-6gp7-4p47Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.