CVE-2026-24126: 
Python vulnerability analysis and mitigation

CVE-2026-24126 is an argument injection vulnerability in Weblate's SSH management console that allows a high-privileged attacker to inject malicious arguments into the ssh-add command when adding SSH host keys. It affects all Weblate versions prior to 5.16.0 and was reported by researcher alexb_616 via HackerOne, with the fix merged on January 22, 2026, and the advisory published on February 16, 2026. The CVSS v3.1 base score varies by source: the GitHub Advisory Database rates it 6.6–6.8 (Moderate), while Feedly's estimate places it at 9.1 (Critical) (GitHub Advisory, Weblate Advisory).

The root cause is CWE-88 (Improper Neutralization of Argument Delimiters in a Command — Argument Injection). The SSHAddForm in weblate/wladmin/forms.py did not apply any domain or IP validation to the host field, and the add_host_key function in weblate/vcs/ssh.py passed the unsanitized hostname directly to ssh-keyscan and subsequently ssh-add as a command argument. An attacker with access to the Weblate management console could supply a crafted hostname string (e.g., beginning with a dash, -option) that would be interpreted as a flag by the underlying SSH utilities, enabling argument injection. The fix introduced a DomainOrIPValidator on the form field and a new extract_url_host_port helper that validates hostnames before any SSH command is invoked (GitHub Commit, Weblate Advisory).

A successful exploit could allow a high-privileged attacker to manipulate the behavior of ssh-keyscan and ssh-add, potentially leading to unauthorized access to SSH keys managed by the Weblate instance, compromise of system integrity, or denial of service. Because the scope is marked as Changed, the impact can extend beyond the Weblate application itself to connected systems that rely on the SSH keys managed through the console. Confidentiality, integrity, and availability of the Weblate application and potentially linked repositories or infrastructure could all be affected (GitHub Advisory, Weblate Advisory).

No public proof-of-concept exploit was known at the time of disclosure, and there is no evidence of in-the-wild exploitation. A PoC repository (alexb616/Weblate-CVE-2026-24126) appeared on GitHub around late March 2026, indicating public research interest. The EPSS score is approximately 0.012% (2nd percentile), reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires high privileges (management console access), which significantly limits the attacker pool (GitHub Advisory).

1. Gain Management Console Access: Obtain credentials for a Weblate administrator account with access to the SSH management console (e.g., through credential theft, phishing, or reuse of compromised admin credentials).
2. Navigate to SSH Key Management: Log into the Weblate admin interface and navigate to the SSH management section (/manage/ssh/).
3. Craft a Malicious Hostname: Prepare a hostname value that begins with a dash or contains argument-like strings (e.g., -oProxyCommand=<command>) to be interpreted as flags by ssh-keyscan or ssh-add.
4. Submit the Payload: Submit the crafted hostname via the "Add host key" form (action=add-host, host=-oProxyCommand=...). Because no validation was applied to the host field in vulnerable versions, the value is passed directly to the SSH utilities.
5. Achieve Argument Injection: The injected argument is processed by ssh-keyscan or ssh-add, potentially causing unintended SSH client behavior such as executing a proxy command, leaking key material, or causing a denial of service (GitHub Commit, Weblate Advisory).

• Logs: Weblate application logs showing POST requests to /manage/ssh/ with action=add-host and a host parameter containing leading dashes, special characters, or SSH option strings (e.g., -oProxyCommand, -i, -L).
• Process: Unexpected child processes spawned by the Weblate service account from ssh-keyscan or ssh-add with unusual arguments; outbound network connections initiated by SSH utilities to unexpected hosts or ports.
• File System: Unexpected modifications to the known_hosts file in the Weblate data directory, or new SSH key files created outside of normal operational patterns.
• Network: Outbound SSH or TCP connections from the Weblate server to hosts not associated with configured repositories, particularly if initiated shortly after a management console action.

Upgrade Weblate to version 5.16.0 or later, which introduces DomainOrIPValidator on the SSH host input field and a validated extract_url_host_port helper to prevent argument injection. As a temporary workaround, strictly limit access to the Weblate management console to only trusted administrative users, reducing the attack surface until patching is feasible. The patch was merged on January 22, 2026 (PR #17722) and released in version 5.16.0 (GitHub Advisory, GitHub Commit).

The vulnerability was reported to the Weblate project by researcher alexb_616 through HackerOne and was promptly addressed by maintainer nijel. Red Hat also tracked the advisory. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database entries (Weblate Advisory).