CVE-2026-22251

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22251", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-07T05:19:12.921Z", "datePublished": "2026-01-12T17:55:09.699Z", "dateUpdated": "2026-01-12T18:43:53.664Z"}, "containers": {"cna": {"title": "wlc may leak API keys due to an insecure API key configuration", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766"}, {"name": "https://github.com/WeblateOrg/wlc/pull/1098", "tags": ["x_refsource_MISC"], "url": "https://github.com/WeblateOrg/wlc/pull/1098"}, {"name": "https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797", "tags": ["x_refsource_MISC"], "url": "https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797"}], "affected": [{"vendor": "WeblateOrg", "product": "wlc", "versions": [{"version": "< 1.17.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T17:55:09.699Z"}, "descriptions": [{"lang": "en", "value": "wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers."}], "source": {"advisory": "GHSA-9rp8-h4g8-8766", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-12T18:43:08.912343Z", "id": "CVE-2026-22251", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T18:43:53.664Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22251", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-12T18:43:08.912343Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T18:43:24.564Z"}}], "cna": {"title": "wlc may leak API keys due to an insecure API key configuration", "source": {"advisory": "GHSA-9rp8-h4g8-8766", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "WeblateOrg", "product": "wlc", "versions": [{"status": "affected", "version": "< 1.17.0"}]}], "references": [{"url": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766", "name": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/WeblateOrg/wlc/pull/1098", "name": "https://github.com/WeblateOrg/wlc/pull/1098", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797", "name": "https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T17:55:09.699Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22251", "state": "PUBLISHED", "dateUpdated": "2026-01-12T18:43:53.664Z", "dateReserved": "2026-01-07T05:19:12.921Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-12T17:55:09.699Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "wlc", "vendor": "WeblateOrg", "versions": [{"status": "affected", "version": "< 1.17.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:weblate:wlc:*:*:*:*:*:*:*:*", "matchCriteriaId": "B01083E5-842F-4D93-8069-D4578C071C90", "versionEndExcluding": "1.17.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers."}, {"lang": "es", "value": "wlc es un cliente de l\u00ednea de comandos de Weblate que utiliza la API REST de Weblate. Antes de la versi\u00f3n 1.17.0, wlc admit\u00eda proporcionar claves de API sin \u00e1mbito en la configuraci\u00f3n. Esta pr\u00e1ctica fue desaconsejada durante a\u00f1os, pero el c\u00f3digo nunca fue eliminado. Esto podr\u00eda causar que la clave de API se filtre a diferentes servidores."}], "id": "CVE-2026-22251", "lastModified": "2026-06-17T10:19:38.253", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22251", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-12T18:43:08.912343Z", "version": "2.0.3"}}]}, "published": "2026-01-12T18:15:49.457", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/WeblateOrg/wlc/pull/1098"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:01:04.248462+00:00", "value": {"mitigation_remediation": ["Upgrade the wlc client to version 1.17.0 or later, where unscoped key support has been removed.", "Replace any existing unscoped API keys with scoped keys that are limited to the necessary permissions.", "Rotate API keys that may have been exposed and audit configuration files to ensure no residual unscoped keys remain."], "summary": {"action": "Patch", "impact": "Information Disclosure via API Key Leak"}, "threat_synthesis": {"affected_systems": "Manufactured by WeblateOrg, the wlc client, versions prior to 1.17.0, contains this flaw. The affected packages are the command\u2011line client \u2018wlc\u2019 and any instance that relies on it to interact with Weblate\u2019s REST API.", "description_and_impact": "The vulnerability resides in the Weblate command\u2011line client, wlc, which allows unscoped API keys to be configured. Unscoped keys are discouraged, but the code path remained present, enabling the key to be unintentionally forwarded to or observed by other servers. Exposure of an API key grants an attacker full API privileges, potentially allowing them to read, modify, or delete data in the Weblate instance. The weakness is identified as a confidentiality violation.", "risk_and_exploitability": "The CVSS score of 5.3 places the issue in the moderate range, while the EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. The flaw is not listed in the CISA Kennedylike Vulnerabilities catalog. The likely attack vector is misuse or misconfiguration of API keys within the client or inadvertent leakage to intermediate servers during API requests. Exploitation would require the attacker to obtain the leaked key, after which they could gain unauthorized access to the API endpoints."}}}}, "created": "2026-01-13T09:27:13.081117+00:00", "updated": "2026-04-18T07:15:25.844822+00:00", "vendors": ["weblateorg", "weblateorg$PRODUCT$wlc"]}