CVE-2026-62364

wlc may disclose API tokens to project-configured URLs

Workarounds

Without upgrading, users can avoid the issue by explicitly pinning the API URL whenever using an unscoped key:

WLC_URL=https://hosted.weblate.org/api/ WLC_KEY=... wlc ...

or:

wlc --url https://hosted.weblate.org/api/ --key ... ...

Alternatively, use URL-scoped keys in the [keys] section instead of WLC_KEY or --key, and avoid running wlc with secrets in untrusted checkouts.

• The issue was independently reported by type5afe and visionx7 using HackerOne.

wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration.

If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLC_KEY or --key without also pinning the URL, wlc would send the token to the project-configured URL.

Impacted users are those running wlc in untrusted repositories, pull request checkouts, or directories with untrusted ancestor configuration while using WLC_KEY or --key.

CVE-2026-62364 has a CVSS score of 2.3 (Low). The vector is requires local access, high privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.0.1); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

The issue is patched in wlc 2.0.1 via https://github.com/WeblateOrg/wlc/pull/1500.

The fix rejects unscoped keys when the API URL comes from automatically discovered project configuration:

• WLC_KEY now requires WLC_URL.
• --key now requires --url.
• URL-scoped keys in the [keys] configuration section remain supported.

Users should upgrade to wlc 2.0.1 or newer.

1. What is CVE-2026-62364? CVE-2026-62364 is a low-severity security vulnerability in wlc (pip), affecting versions < 2.0.1. It is fixed in 2.0.1.
2. How severe is CVE-2026-62364? CVE-2026-62364 has a CVSS score of 2.3 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of wlc are affected by CVE-2026-62364? wlc (pip) versions < 2.0.1 is affected.
4. Is there a fix for CVE-2026-62364? Yes. CVE-2026-62364 is fixed in 2.0.1. Upgrade to this version or later.
5. Is CVE-2026-62364 exploitable, and should I be worried? Whether CVE-2026-62364 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-62364 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-62364? Upgrade wlc to 2.0.1 or later.

Other vulnerabilities in wlc