CVE-2026-24126

MEDIUM

6.6

Descripcion

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

Detalles CVE

Puntuacion CVSS v3.16.6

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosHIGH

Interaccion usuarioNONE

Publicado2/19/2026

Ultima modificacion2/19/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

weblate:weblate

Debilidades (CWE)

CWE-88

Referencias

https://github.com/WeblateOrg/weblate/commit/78773cc141ce0a97900c11341e6cf856451395fd(security-advisories@github.com)

https://github.com/WeblateOrg/weblate/pull/17722(security-advisories@github.com)

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-33fm-6gp7-4p47(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.