CVE-2026-24126 is an argument injection flaw (CVSS 6.6, medium) in Weblate, the web localization tool. Before 5.16.0, the SSH management console did not validate input when adding an SSH host key, which could inject arguments into ssh-add. Upgrade to 5.16.0, or limit access to the console.
What's affected
Weblate before 5.16.0. The advisory lists 5.16 as the patched version. The attacker needs access to the SSH management console, which the vector shows as a high privilege requirement.
How to check if you're exposed
pip show weblate
docker ps --format "table {{.Names}}\t{{.Image}}"
Use the first command for a pip install and the second for Docker. Then check who holds administrator access to Weblate, since the console is an admin feature.
What to do now
- Upgrade Weblate to 5.16.0 or later.
- As the advisory's workaround, limit access to the management console to the few people who need it.
- Review administrator accounts, and enable two factor authentication for them.
- Check the SSH keys and host entries configured in Weblate for ones you do not recognize.
Why it matters
The weakness is CWE-88, argument injection. When an application builds a command line from user input, a value that looks like an option can change what the program does. Passing values after a separator that ends option parsing, or validating the value strictly, prevents it.
The score is medium because administrator rights are needed, but the scope changes in the vector, since the effect reaches beyond the web app. Admin consoles that run system commands deserve the same care as public endpoints. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 6.6, published 2026-02-19. In the vector, the attacker works over the network, needs a high privilege (administrator level) account, and the attack is low in complexity. User interaction is not needed. Impact on confidentiality is low, on integrity low and on availability low.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Quick check
Can a normal translator account exploit this?
The advisory points to the SSH management console, an administrative feature, and the vector requires high privileges. Limiting that access is the stated workaround.
Sources
Last reviewed: 19 October 2026.
