CVE-2026-62364

Executive Summary

CVE-2026-62364 is an information-disclosure vulnerability in wlc, the Weblate command-line client that communicates with the Weblate REST API. Prior to version 2.0.1, an automatically discovered configuration file (.weblate, .weblate.ini, or weblate.ini) can dictate the API URL while an unscoped API token is supplied through the WLC_KEY environment variable or --key flag without a matching WLC_URL or --url. When the client runs inside an untrusted repository or directory with an attacker-controlled ancestor configuration, the unscoped token may be transmitted to an attacker-controlled, project-configured URL. URL-scoped keys defined under [keys] are not affected. The CVSS v3.1 base score is 2.3 (Low), reflecting local attack vector, high complexity, high privileges, and user interaction, with scope change and limited confidentiality impact only.

Technical Analysis

The vulnerability class is improper handling of sensitive credentials (CWE-200, Exposure of Sensitive Information). The client wlc performs automatic configuration discovery from .weblate, .weblate.ini, or weblate.ini. This discovery selects the API URL against which the client will operate. Separately, authentication can be supplied via an unscoped API token through WLC_KEY or --key. The defect is that when an unscoped token is present but no explicit WLC_URL or --url is provided, the automatically discovered configuration is trusted to define the destination URL. In an untrusted working directory — such as a freshly cloned third-party repository, a pull request checkout, or any directory whose ancestor directories contain an attacker-controlled configuration — the discovered URL can be pointed at a host controlled by the attacker. Under those conditions, wlc transmits the token to that attacker-controlled endpoint.

The relevant trust boundary is the filesystem hierarchy from which configuration is auto-discovered. Because configuration discovery appears to walk upward through ancestor directories, placing a crafted configuration in a location that becomes an ancestor of the client's working directory is sufficient to influence URL selection. The attack requires that the victim already possess a valid Weblate API token loaded into the environment (as WLC_KEY) or passed on the command line (--key).

Mitigating factors embedded in the design are important to note factually: URL-scoped keys stored in the [keys] configuration section are explicitly not affected, because the destination URL associated with each scoped key is fixed in configuration rather than selected dynamically. The CVSS vector reflects constrained impact: local vector (AV:L), high attack complexity (AC:H), high privileges required (PR:H), user interaction required (UI:R), scope change (S:C) because the token is disclosed to a party outside the original security authority of the Weblate instance, and limited confidentiality impact (C:L) with no integrity or availability impact.

Insufficient technical detail is available in the NVD description to describe specific functions, internal classes, or parsing routines involved in configuration discovery. Only the file names (.weblate, .weblate.ini, weblate.ini), the configuration key groups ([keys]), the environment variable WLC_KEY, and the command-line flags --key, WLC_URL, and --url are stated verbatim and should be relied upon.

Exploitation Scenarios

The following attack chain is derived strictly from the NVD description. It is a vulnerability-class description; the exact discovery routines are not enumerated in available data. No public PoC is available, and the chain below is inferred from the vulnerability class.

1. Reconnaissance / target identification. The attacker identifies developers or automation accounts that use wlc and that hold a valid Weblate API token, and identifies a repository, pull request, or shared directory that such a user or automation system is likely to check out and operate within. The attacker needs a location whose contents (or ancestor configuration) become visible to the client.

2. Triggering the flaw. The attacker places a crafted configuration file (.weblate, .weblate.ini, or weblate.ini) so that it is automatically discovered when wlc runs in the target directory or its descendants. This crafted configuration selects an API URL under the attacker's control. The attacker arranges for the victim's invocation of wlc to occur without an explicit WLC_URL or --url, while the victim's environment supplies an unscoped token via WLC_KEY or --key. Because the unscoped token has no URL binding, the client falls back to the discovered URL.

3. Transmission of the credential. When the victim runs wlc in that context (for example, while working inside the untrusted checkout), the client resolves the API URL from the automatically discovered configuration and transmits the unscoped token to it. This constitutes the credential-exfiltration step — no exploitation of a memory-safety or injection flaw is required; the token is simply sent to the wrong endpoint.

4. Post-exploitation impact. The attacker now possesses a valid Weblate API token. Depending on the token's scope, the attacker may access or modify translation projects, project metadata, or other resources reachable through the Weblate REST API that the token authorizes. Because the impact is limited to confidentiality in the CVSS assessment and integrity/availability impacts are None, the primary consequences are information disclosure and the follow-on actions permitted by the stolen token. Note that URL-scoped keys under [keys], which would not be exfiltrated in this manner, are explicitly out of scope for this issue.

Impact Assessment

The CVSS v3.1 base score is 2.3 with vector CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N. Attack Vector is Local (AV:L): the attacker must influence a filesystem location or configuration interactively reachable by the victim. Attack Complexity is High (AC:H): success depends on the presence of an unscoped token and the absence of an explicit URL, plus the victim operating in an untrusted context. Privileges Required are High (PR:H): the attacker effectively needs the victim to hold a valid Weblate token and the ability to place or influence configuration. User Interaction is Required (UI:R): the victim must run wlc under the poisoned context. Scope is Changed (S:C): a token valid for one Weblate installation is disclosed to a party outside that installation's authority. Confidentiality is Low (C:L) and there is no Integrity (I:N) or Availability (A:N) impact.

Business impact centers on credential compromise: a stolen Weblate API token may enable unauthorized access to translation data and project resources within the Weblate instance it authenticates to. Blast radius is bounded by the token's scope, but unscoped tokens have broad authority. The vulnerability is not listed in CISA KEV, no public exploit code exists, and no Nuclei template is available. EPSS has not been scored by FIRST.org. Affected systems are any environment running wlc prior to 2.0.1 where an unscoped token is supplied without a matching URL, especially CI/CD automation and developer workstations that operate inside externally sourced repositories. To keep the assessment precise, no specific threat actor campaigns or exploit-in-the-wild activity are claimed, as none are evidenced.

Detection Guidance

Sigma Rule

title: Suspicious wlc Configuration Discovery Directing Unscoped Weblate Token
id: 1c9e4b1a-3f2d-4b7c-9a11-7c0b2a6e5f01
status: experimental
description: Detects creation or modification of wlc configuration files in untrusted contexts and the execution of the wlc client in environments referencing WLC_KEY, which may indicate token-redirection abuse.
author: valtersit.com
logsource:
  category: process_creation
  product: linux
detection:
  selection_wlc_proc:
    Image|endswith: '/wlc'
  selection_unscoped_token:
    CommandLine|contains:
      - '--key'
  selection_env:
    CommandLine|contains: 'WLC_KEY'
  condition: selection_wlc_proc and (selection_unscoped_token or selection_env)
fields:
  - CommandLine
  - Image
  - User
falsepositives:
  - Legitimate interactive or CI use of wlc with an explicit --url
  - Administrators invoking wlc from trusted directories with scoped keys
level: low

YARA Rule

rule wlc_config_url_hijack
{
    meta:
        author      = "valtersit.com"
        description = "Detects wlc configuration files that may redirect an unscoped Weblate API token to attacker-controlled URLs"
        reference   = "CVE-2026-62364"
        date        = "2026-01-01"

    strings:
        $f1 = ".weblate"
        $f2 = ".weblate.ini"
        $f3 = "weblate.ini"
        $url = /https?:\/\/[^\s"']+/
        $wlc_key = "WLC_KEY"
        $keys_section = "[keys]"

    condition:
        (filename matches /\.weblate(\.ini)?$/ or filename matches /weblate\.ini$/) and
        ($url or $keys_section) and
        not $wlc_key
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-62364 wlc Unscoped Weblate Token Transmitted to Discovered URL"; flow:established,to_server; http.header; content:"Authorization"; nocase; http.header; content:"Token"; nocase; http.host; pcre:"/^(?!(?:[a-z0-9-]+\.)?weblate\.(org|com)$)/i"; classtype:attempted-recon; sid:2026062364; rev:1; metadata:created_at 2026_01_01, reference cve,CVE-2026-62364;)

Elastic Detection

process where event.type == "start" and process.name == "wlc" and
  process.command_line : ("--key" or "WLC_KEY") and
  not process.command_line : ("--url" or "WLC_URL")

Splunk SPL Query

index=endpoint OR index=process
| eval cmd=coalesce(process_command_line, CommandLine, process)
| where (like(cmd, "%/wlc%") OR like(cmd, "% wlc %"))
    AND (like(cmd, "%--key%") OR like(cmd, "%WLC_KEY%"))
    AND NOT (like(cmd, "%--url%") OR like(cmd, "%WLC_URL%"))
| table _time host user cmd
| sort - _time

Wazuh OSSEC Rule

<group name="weblate,wlc,credential_exposure,">
  <rule id="100364" level="6">
    <decoded_as>json</decoded_as>
    <field name="command">\.?/wlc</field>
    <field name="command">--key|WLC_KEY</field>
    <description>CVE-2026-62364: wlc invoked with unscoped Weblate token and no explicit URL</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in version 2.0.1, but no patch artifacts were tracked by the available sources; verify the fix directly against the upstream project before relying on it.

1. Immediate mitigations:

• Supply an explicit destination URL in every wlc invocation via WLC_URL or --url so that automatically discovered configuration cannot select the API endpoint.
• Prefer URL-scoped keys stored in the [keys] configuration section, which the NVD description states are not affected.
• Avoid running wlc with an unscoped token in untrusted repositories, pull request checkouts, or directories that contain untrusted ancestor configuration.
• In CI/CD, pin the API URL explicitly and isolate untrusted checkouts from directories that can influence configuration discovery.

2. Patch/upgrade steps:

• Upgrade wlc to version 2.0.1 (per the NVD description) once the fix is confirmed available in your distribution or package index.
• After upgrading, re-test invocations in untrusted working directories to confirm the configuration-discovery behavior no longer redirects token traffic.
• Rotate any Weblate API tokens that may have been used as unscoped tokens in potentially untrusted contexts.

3. Long-term hardening:

• Enforce URL-scoped tokens as organizational policy; deprecate unscoped token usage.
• Constrain configuration discovery to trusted paths where feasible, and review any configuration files committed to repositories for unexpected URL directives.
• Monitor for configuration files named .weblate, .weblate.ini, or weblate.ini appearing in externally sourced code.
• Treat translation client credentials as secrets: limit token scope, rotate periodically, and audit Weblate API access logs for anomalous source endpoints.

References

• NVD — CVE-2026-62364: https://nvd.nist.gov/vuln/detail/CVE-2026-62364
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK — T1552 Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• Weblate project documentation (wlc client and REST API) — consult the upstream project for the 2.0.1 release and configuration semantics
• CISA Known Exploited Vulnerabilities catalog: CVE-2026-62364 is NOT listed as of this report; no exploit-in-the-wild evidence or threat actor campaign is known.