CVE-2026-62364 in wlc
Summary
by MITRE • 09/23/2026
wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLC_KEY or --key without a matching WLC_URL or --url. When wlc runs in an untrusted repository, pull request checkout, or directory with untrusted ancestor configuration, it can send the token to an attacker-controlled project-configured URL. URL-scoped keys in [keys] are not affected. This issue is fixed in version 2.0.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Weblate command-line client versions prior to 2.0.1 represents a critical configuration-based security flaw that compromises the integrity of API authentication tokens through unintended context switching. The core technical deficiency lies in how the application resolves its target endpoint when an unscoped API token is provided via environment variables or command line arguments without an explicitly defined URL override. In this specific scenario, if no WLC_URL variable or --url flag is present to enforce a known-good destination, the client falls back to automatically discovering configuration from local files such as .weblate, .weblate.ini, or weblate.ini located in the current directory or its ancestors. This automatic discovery mechanism allows an attacker who controls the project's repository structure or has access to untrusted directories where pull requests are checked out to inject a malicious configuration file containing a URL pointing to their own server.
This behavior creates a severe risk of credential exfiltration, particularly in continuous integration and development environments where code from external contributors is frequently merged into main branches via pull request workflows. When the wlc client executes within such an untrusted repository or directory with compromised ancestor configurations, it inadvertently reads the attacker-controlled URL setting while retaining the legitimate API token provided by the user. Consequently, sensitive authentication credentials are transmitted to a malicious endpoint rather than the intended Weblate instance. It is important to note that this vulnerability does not affect users who utilize URL-scoped keys defined in the [keys] section of their configuration files, as these tokens are bound to specific domains and would fail or be rejected if sent to an unauthorized host, thereby providing a layer of defense for those employing stricter key management practices.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) in the context of configuration parsing, but more accurately maps to CWE-200 Exposure of Sensitive Information to an Unauthorized Actor and CWE-538 Insertion of Sensitive Data into Log File or Other Component depending on how the token is handled post-exfiltration. In terms of the MITRE ATT&CK framework, this scenario exemplifies techniques related to Credential Access through Untrusted Software Supply Chain attacks, specifically leveraging configuration file manipulation to intercept authentication materials during routine operations like pull request checks. The attack vector relies heavily on social engineering or repository compromise rather than direct exploitation of code execution flaws, highlighting the risks associated with trusting local configuration files in collaborative development environments.
To mitigate this risk and prevent accidental credential leakage, organizations must enforce strict separation between untrusted source code and trusted application configurations. Users should avoid storing API tokens in environment variables that are automatically picked up by tools without explicit URL constraints when operating within shared or external repositories. The most effective remediation is to upgrade the Weblate command-line client to version 2.0.1 or later, where this automatic fallback behavior has been corrected to prevent selecting an attacker-controlled URL from local configuration files in untrusted contexts. Additionally, adopting a policy of using URL-scoped API tokens as recommended by the vendor provides defense-in-depth, ensuring that even if a malicious configuration is present, the token remains useless outside its intended domain. Security teams should also audit CI/CD pipelines to ensure that wlc commands are executed with explicit --url flags or WLC_URL environment variables set to known-good values, thereby removing any ambiguity in endpoint resolution regardless of local file contents.