CVE-2026-77573

Executive Summary

CVE-2026-77573 is a time-of-check/time-of-use (TOCTOU) vulnerability in Weblate, a web-based continuous localization platform, affecting all versions prior to 2026.8. A low-privileged user permitted to manage component repository URLs can perform server-side request forgery (SSRF) against internal services by exploiting DNS rebinding during VCS operations such as clone, fetch, or push. The vulnerability is rated CVSS 3.5 (Low) due to high attack complexity and limited confidentiality impact, but it can expose private repository contents in environments that permit untrusted repository hostnames while enforcing VCS_RESTRICT_PRIVATE=True. Organizations running self-hosted Weblate instances as public-facing or semi-trusted services are affected and should prioritize upgrading to version 2026.8 or implementing the interim mitigations described below.

Technical Analysis

The vulnerability is classified under CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition) and arises from an inconsistency in the number of DNS resolution steps performed during Weblate's repository operations.

Vulnerability Mechanism:

During VCS operations (e.g., clone, fetch, push, pull), Weblate performs a security validation step that attempts to prevent connections to private or internal network addresses. This validation typically involves resolving the repository hostname to an IP address and verifying that the resolved address is not in a private/restricted range (e.g., RFC1918 addresses, link-local, loopback). This behavior is enforced when the VCS_RESTRICT_PRIVATE=True setting is enabled.

The flaw is that Weblate's validation logic and the external VCS client (e.g., git, mercurial, subversion) that subsequently performs the actual network connection do not share the same DNS resolution. Specifically:

1. Weblate resolves the hostname once to validate the IP address.
2. The VCS client, invoked later, performs a second, independent DNS lookup for the same hostname.
3. Between these two lookups, the attacker can re-point the hostname from a public IP to a private/internal IP address via DNS rebinding (e.g., by controlling the TTL of a DNS record and toggling responses).

Since the hostname passes the first validation check (resolving to a public IP), the VCS client's second resolution—which may now return an internal IP—is not re-validated. The VCS client, being a standard command-line tool, has no knowledge of Weblate's security constraints and will connect to whatever address the second DNS response returns.

Attack Surface:

The attack surface is restricted to users who hold the permission to manage component repository URLs. In Weblate, this corresponds to a role able to edit component settings (e.g., a "Manage components" translation or project administrator role) but not necessarily a full site administrator. The attacker can supply an arbitrary repository hostname as part of configuring a component's VCS remote URL.

When the VCS operation is triggered (manually or via scheduled updates), Weblate will invoke the external VCS client with the attacker-supplied URL. The TOCTOU window between Weblate's validation lookup and the VCS client's connection lookup is the exploitable gap.

Code-Level Considerations:

The NVD description does not name specific functions, classes, or file paths. Weblate's architecture relies on external command-line VCS binaries (git, hg, svn) invoked as subprocesses. The validation logic and the subprocess invocation are separated by enough time (process spawn, argument construction, I/O) that a DNS rebinding window exists. No further code-level specifics are disclosed in the available data, and insufficient technical detail is available to reference exact internal function names.

Affected Versions:

All Weblate versions prior to 2026.8 are vulnerable when:

• Repository hostnames supplied by users are not pre-vetted (i.e., untrusted), and
• VCS_RESTRICT_PRIVATE=True is configured (the intended security control that this flaw bypasses).

Exploitation Scenarios

No public PoC or exploit code is currently available. The following attack chain is inferred strictly from the vulnerability class and the NVD description.

Step 1 — Reconnaissance and Target Identification:

The attacker must first identify a Weblate instance that meets the preconditions:

• The instance permits users to manage component repository URLs (not restricted to trusted admins only).
• The instance has VCS_RESTRICT_PRIVATE=True enabled, indicating the operator intends to block private-network access.
• The instance is reachable over the network, and the attacker can authenticate with a low-privileged account that has "manage component" permissions.

Public-facing Weblate instances can be discovered via Shodan/Fofa using banner and title fingerprints (e.g., http.title:"Weblate", "X-Weblate-Server" headers) or via default installation paths.

Step 2 — Triggering the Flaw (DNS Rebinding Setup):

The attacker registers a domain name (or controls an existing one) such as evil.example.com and configures its DNS server to return alternating answers:

• First query (to 127.0.0.1's DNS server, i.e., the Weblate server's resolver): returns a public IP (e.g., 203.0.113.10), passing Weblate's initial validation.
• Subsequent queries (after a short TTL, e.g., 0–5 seconds): return an internal/private IP (e.g., 192.168.1.100 or 10.0.0.5).

The attacker sets a very short TTL to ensure the second lookup within the TOCTOU window has a high chance of hitting the "private" answer.

Step 3 — Vulnerability-Class Execution:

The attacker authenticates to Weblate and creates or modifies a component, setting the repository URL to git://evil.example.com/repo.git (or https://, ssh:// as supported). The attacker then triggers a VCS operation—either manually via the web UI (e.g., "Update", "Push", "Fetch") or waits for Weblate's automated scheduled sync.

When the operation executes:

1. Weblate's pre-flight check resolves evil.example.com → gets the public IP → passes validation.
2. Weblate spawns the VCS client (git/hg/svn) with the URL.
3. The VCS client performs its own DNS resolution of evil.example.com → gets the private IP → connects to an internal service that speaks the VCS protocol.

Step 4 — Post-Exploitation Impact:

The external VCS client (e.g., git) will attempt to negotiate a repository connection with the internal host. If the internal host runs a VCS daemon (git daemon, svnserve, or an HTTP endpoint with git smart HTTP), the attacker may be able to:

• Clone/fetch a private repository residing on an internal host, if the host's VCS service allows read access.
• In the case of git:// or ssh://, the attacker could potentially send malicious repository contents (during a push or clone of an attacker-controlled remote) that trigger downstream processing on the internal host.

The primary impact, per CVSS, is confidentiality loss (partial) with no impact on integrity or availability. The CVSS vector also indicates the attack has high complexity (AC:H), requires low privileges (PR:L), and has a changed security scope (S:C) — meaning the compromised component (VCS client internal connection) is outside of Weblate's normal trust boundary.

Impact Assessment

CVSS Analysis (3.5 — Low):

• AV:N — Network-accessible, no physical or local access required.
• AC:H — High attack complexity: requires the attacker to control a DNS name, time the rebinding precisely, and have an internal VCS-compatible service to target.
• PR:L — Low privileges: an authenticated user with component-management rights is sufficient.
• UI:N — No user interaction required beyond the attacker's own actions (scheduled operations can trigger the flaw without operator involvement).
• S:C — Changed scope: the SSRF target (internal VCS service) is outside Weblate's trust boundary.
• C:L — Low confidentiality impact: attacker gains limited read access to internal repository data.
• I:N / A:N — No integrity or availability impact.

Business Impact:

• Data Exposure: If internal Git/SVN repositories host proprietary code, credentials, or secrets, their contents could be exfiltrated if read access is configured permissively. Many VCS servers default to repository access based on filesystem permissions or simple auth; in misconfigured environments, anonymous read may be possible.
• Internal Network Reconnaissance: Although the protocol is limited to VCS clients, the attacker can probe which internal hosts respond to VCS handshakes, mapping internal services.
• Lateral Movement Priming: In rare cases, an internal host running a VCS service may be configured to trigger post-receive hooks (e.g., build pipelines). While not directly exploitable per the CVE data, the interaction could serve as a stepping stone for further research.

Blast Radius:

Organizations at greatest risk are those running:

• Self-hosted Weblate with multi-tenancy (multiple projects/teams) where component-management permissions are delegated to non-administrative users.
• Weblate instances accessible from the internet.
• Internal VCS services (GitLab, Gitea, GitHub Enterprise, or plain git-daemon/svnserve) on private networks that allow unauthenticated read or weak authentication.

The reachability of internal services is network-dependent; in well-segmented environments where Weblate's egress is restricted or internal VCS services are not on the same network segment as Weblate, the practical risk is minimal. However, in flat or lightly segmented networks, the risk materializes.

Detection Guidance

Detection of this vulnerability is challenging because it manifests purely as legitimate VCS client traffic to an unexpected destination. The key indicators are (1) DNS rebinding patterns from the Weblate host, and (2) outbound VCS protocol connections to private/internal IP ranges originating from the Weblate server.

Sigma Rule

title: Weblate DNS Rebinding SSRF via VCS Operations
id: 3f8a1c9e-5b2d-4e7f-8a3c-2d9f4b0a6c1e
status: experimental
description: Detects DNS rebinding patterns and outbound VCS client connections to private IP ranges from a Weblate server, indicating possible SSRF exploitation of CVE-2026-77573.
author: Valtersit Threat Intel
date: 2026/01/15
references:
    - CVE-2026-77573
logsource:
    category: process_creation
    product: linux
detection:
    selection_vcs_client:
        Image|endswith:
            - '/git'
            - '/git-remote-https'
            - '/hg'
            - '/svn'
    selection_private_dest:
        # Captures common IP-address arguments passed to git/hg/svn
        CommandLine|contains:
            - 'git://192.168.'
            - 'git://10.'
            - 'git://172.16.'
            - 'git://172.17.'
            - 'git://172.18.'
            - 'git://172.19.'
            - 'git://172.20.'
            - 'git://172.21.'
            - 'git://172.22.'
            - 'git://172.23.'
            - 'git://172.24.'
            - 'git://172.25.'
            - 'git://172.26.'
            - 'git://172.27.'
            - 'git://172.28.'
            - 'git://172.29.'
            - 'git://172.30.'
            - 'git://172.31.'
            - 'git://127.'
            - 'git://169.254.'
            - 'https://192.168.'
            - 'https://10.'
            - 'https://172.16.'
            - 'https://172.17.'
            - 'https://172.18.'
            - 'https://172.19.'
            - 'https://172.20.'
            - 'https://172.21.'
            - 'https://172.22.'
            - 'https://172.23.'
            - 'https://172.24.'
            - 'https://172.25.'
            - 'https://172.26.'
            - 'https://172.27.'
            - 'https://172.28.'
            - 'https://172.29.'
            - 'https://172.30.'
            - 'https://172.31.'
            - 'https://127.'
            - 'https://169.254.'
    condition: selection_vcs_client and selection_private_dest
falsepositives:
    - Legitimate internal mirrors where private addresses are intentionally used in repo URLs.
level: high

YARA Rule

rule Weblate_DNS_Rebinding_SSRF_Indicator
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects log patterns or configuration snippets indicating DNS rebinding attempts against Weblate VCS operations"
        reference = "CVE-2026-77573"
        date = "2026-01-15"
    strings:
        $a = "VCS_RESTRICT_PRIVATE" ascii nocase
        $b = "git clone" ascii nocase
        $c = "git fetch" ascii nocase
        $d = "git push" ascii nocase
        $e = "resolving hostname" ascii nocase
        $f = "dns" ascii nocase
        $g = "rebinding" ascii nocase
        $h = "TXTOCU" ascii nocase
        $i = "timeofcheck" ascii nocase
        $j = "repository url" ascii nocase
    condition:
        (uint16(0) == 0x0A0D or uint16(0) == 0x0D0A) and any of ($a, $b, $c, $d, $e, $f, $g, $h, $i, $j)
}

Note: The YARA rule targets log files, configuration excerpts, or technical notes containing keywords from the vulnerability. A more precise binary rule would require specific Weblate code artifacts that are not publicly available in the provided data.

Suricata IDS Rule

alert tcp $WEBLATE_SERVER any -> $HOME_NET any (msg:"Webleate CVE-2026-77573 Potential SSRF - VCS client connecting to private IP"; flow:to_server,established; content:"git-upload-pack"; nocase; distance:0; content:"git-receive-pack"; nocase; distance:0; sid:202677573; rev:1; metadata:reference CVE-2026-77573;)

Note: The rule above is intentionally simplistic due to lack of known signatures. A realistic deployment would use a rule like the following to catch VCS protocol verbs to private IPs:

alert tcp any any -> any 9418 (msg:"Webleate CVE-2026-77573 Potential SSRF - Outbound git protocol (port 9418) to network"; flow:to_server,established; content:"git-upload-pack"; sid:202677574; rev:1; metadata:reference CVE-2026-77573;)

A more robust approach is to rely on the IDS/NSM to flag any outbound VCS-protocol traffic from the Weblate server to RFC1918, loopback, or link-local addresses. Since Suricata rules cannot easily match on "destination is private" without custom logic, the recommendation is to use JS or Lua scripting within Suricata, or pair this rule with a network flow/logging solution that flags destination IPs.

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where event.type == "start" and process.name : ("git", "git-remote-https", "hg", "svn") and
     (process.args : ("192.168.*", "10.*", "172.16.*", "172.17.*", "172.18.*", "172.19.*", "172.20.*", "172.21.*", "172.22.*", "172.23.*", "172.24.*", "172.25.*", "172.26.*", "172.27.*", "172.28.*", "172.29.*", "172.30.*", "172.31.*", "127.*", "169.254.*"))]
  [network where event.type == "connection" and
     (destination.ip : "192.168.*" or destination.ip : "10.*" or destination.ip : "172.16.*" or destination.ip : "172.17.*" or destination.ip : "172.18.*" or destination.ip : "172.19.*" or destination.ip : "172.20.*" or destination.ip : "172.21.*" or destination.ip : "172.22.*" or destination.ip : "172.23.*" or destination.ip : "172.24.*" or destination.ip : "172.25.*" or destination.ip : "172.26.*" or destination.ip : "172.27.*" or destination.ip : "172.28.*" or destination.ip : "172.29.*" or destination.ip : "172.30.*" or destination.ip : "172.31.*" or destination.ip : "127.*" or destination.ip : "169.254.*")]

Note: The above EQL rule correlates a local VCS process spawn with an outbound network connection to a private range. It is best-run on the Weblate host with Sysmon/auditd enrichment.

Splunk SPL Query

index=network sourcetype=conn OR sourcetype=netflow
  src_ip=<WEBLATE_SERVER_IP>
  (dest_ip=10.* OR dest_ip=192.168.* OR dest_ip=172.16.* OR dest_ip=172.17.* OR dest_ip=172.18.* OR dest_ip=172.19.* OR dest_ip=172.20.* OR dest_ip=172.21.* OR dest_ip=172.22.* OR dest_ip=172.23.* OR dest_ip=172.24.* OR dest_ip=172.25.* OR dest_ip=172.26.* OR dest_ip=172.27.* OR dest_ip=172.28.* OR dest_ip=172.29.* OR dest_ip=172.30.* OR dest_ip=172.31.* OR dest_ip=127.* OR dest_ip=169.254.*)
  (dest_port=9418 OR dest_port=22 OR dest_port=443 OR dest_port=3690 OR dest_port=80)
  | stats count, values(dest_ip) as dest_ips, values(dest_port) as dest_ports by src_ip, _time
  | sort _time

Additional log source — DNS logs:

index=dns sourcetype=dns
  query="*" 
  | stats count by query, answer, _time
  | where count > 2 AND (answer=10.* OR answer=192.168.* OR answer=172.16.* OR answer=172.17.* OR answer=172.18.* OR answer=172.19.* OR answer=172.20.* OR answer=172.21.* OR answer=172.22.* OR answer=172.23.* OR answer=172.24.* OR answer=172.25.* OR answer=172.26.* OR answer=172.27.* OR answer=172.28.* OR answer=172.29.* OR answer=172.30.* OR answer=172.31.* OR answer=127.* OR answer=169.254.*)
  | where count >= 3

Wazuh OSSEC Rule

<group name="weblate,">
  <rule id="100773" level="10">
    <if_sid>5716</if_sid>
    <field name="command">.*(git|hg|svn).*(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.|169\.254\.).*</field>
    <description>CVE-2026-77573 - Weblate VCS client executed with private IP destination (possible SSRF via DNS rebinding)</description>
    <group>weblate,ssrf,cve_2026_77573,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100774" level="5">
    <if_sid>100773</if_sid>
    <field name="command">git-remote-https|git-remote-http</field>
    <description>CVE-2026-77573 - HTTPS VCS remote to private IP from Weblate process</description>
  </rule>
</group>

Note: The rule relies on Sysmon/auditd command-line logging (associated with syscheck or command monitoring). Adjust the if_sid parent based on your Wazuh configuration for process execution events.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source).

Despite the NVD description stating the issue "is fixed in version 2026.8," no patch artifacts, commits, or vendor advisories were identified in the tracked patch sources. This is an unusual discrepancy; treat the fix as unverified until Weblate publishes an official changelog or advisory. Independently verify that any installed version is ≥ 2026.8, and if not, apply the interim mitigations below.

1) Immediate Mitigations (in order of priority):

• Restrict component-management permissions: Review all user roles and remove VCS repository-URL management permissions from non-trusted users. Only site administrators or a dedicated, vetted "maintainer" group should be able to edit repository URLs.
• Enforce egress filtering: On the Weblate server, block outbound network connections to RFC1918, loopback (127.0.0.0/8), link-local (169.254.0.0/16), and multicast ranges. Apply this via host firewall (iptables/nftables) or at the network perimeter for the specific host.
• Pin repository hostnames: If the platform supports it, require that repository URLs reference pre-approved hostnames (an allowlist). Reject any hostname not in the allowlist.
• Disable scheduled VCS operations: If possible, temporarily disable automated clone/fetch/push tasks until patching is verified, reducing the window in which an attacker can trigger the flaw without user interaction.

2) Patch/Upgrade Steps:

• Upgrade Weblate to version 2026.8 (or later) once the fix is verified. Monitor the official Weblate release notes and security advisories (https://weblate.org) for confirmation that the DNS-rebinding gap has been closed.
• If 2026.8 is not yet available in your distribution channel (Docker image, pip, apt), check for backported security patches or hotfixes.
• After upgrading, verify VCS_RESTRICT_PRIVATE=True still operates as expected by attempting a clone from an internal IP hostname — it should be blocked.

3) Long-Term Hardening:

• Network segmentation: Isolate the Weblate server into a DMZ or dedicated VLAN. Internal VCS servers should not be routable from the Weblate host, or access should require explicit firewall rules.
• DNS security: Deploy DNS response policy and monitor for short-TTL DNS records that alternate between public and private IPs. Use a DNS security tool (e.g., DNSSEC validation, DNS firewall) to flag or drop such records.
• VCS protocol filtering: At the network layer, restrict outbound connections to only the legitimate VCS endpoints used by allowed repositories (port 22, 443, 9418 as needed), with destination allowlists.
• Audit logging: Enable command-line logging for all processes spawned by Weblate's VCS operations to enable retrospective detection of SSRF attempts.
• Access control review: Periodically audit user permissions in Weblate to ensure that repository management is tightly scoped.

References

1. National Vulnerability Database — CVE-2026-77573: https://nvd.nist.gov/vuln/detail/CVE-2026-77573
2. Weblate Official Site (releases/security): https://weblate.org — Monitor for official advisory confirming the 2026.8 fix. (No direct advisory URL available in the provided data; this is the canonical vendor page.)
3. MITRE CVE — CWE-367 (TOCTOU): https://cwe.mitre.org/data/definitions/367.html — Reference for the vulnerability class.
4. OWASP — Server-Side Request Forgery (SSRF): https://owasp.org/www-community/attacks/Server_Side_Request_Forgery — Context for the attack class exploited. (Not a CVE-specific reference but useful for defensive teams.)
5. ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ — MITRE tactic/technique mapping.

Threat Actor Activity / Exploit-in-the-Wild: No known exploit-in-the-wild activity, public PoC, or threat-actor campaign has been identified for CVE-2026-77573 as of this report's date. CISA KEV status is NO. EPSS scoring has not been assigned by FIRST.org yet.