Medium severity · published Jan 12, 2026
CVE-2026-22251
wlc may leak API keys due to an insecure API key configuration
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WL
wlc · WeblateOrg
< 1.17.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22251
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22251
Patch
https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797
Issue Tracking
https://github.com/WeblateOrg/wlc/pull/1098
Vendor Advisory
https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766
More from wlc
8.0
CVE-2026-23535
wlc Path traversal: Unsanitized API slugs in download command
5.5
CVE-2026-22250
wlc can skip SSL verification
4.8
CVE-2026-42150
wlc: print_html outputs API data without HTML escaping, enabling stored XSS
2.3
CVE-2026-62364
wlc may disclose API tokens to project-configured URLs