CVE-2026-34244

OVERVIEW: CVE-2026-34244 is a Server-Side Request Forgery (SSRF) vulnerability affecting Weblate versions prior to 5.17, a web-based localization platform. Users with project administration permissions can configure malicious machine translation service URLs that point to internal network addresses. When Weblate validates these configurations, it makes HTTP requests to attacker-controlled endpoints and reflects up to 200 characters of the response in error messages, enabling partial response exfiltration. SEVERITY: This vulnerability carries a CVSS score of 5.0 (Medium) with a network-based attack vector requiring low complexity and low privileges (project administrator role). The attack requires no user interaction and has a changed scope, resulting in low confidentiality impact. While the vulnerability does not enable code execution or availability disruption, it allows attackers to probe internal network resources and read sensitive response data. EXPLOITATION STATUS: There is no evidence of active exploitation in the wild. The vulnerability has not been assigned to the KEV catalog and remains inactive on security hotlists. The EPSS score of 0.0001 indicates minimal probability of exploitation across the broader threat landscape. Organizations should prioritize upgrading to version 5.17 or implement the WEBLATE_MACHINERY configuration restrictions as interim mitigation.