CVE-2026-22251

wlc may leak API keys due to an insecure API key configuration

State: Published
Severity: 5.3 Medium
Published: Jan 12, 2026
Updated: Jan 12, 2026
Reserved: Jan 7, 2026

Description

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
wlcWeblateOrg	< 1.17.0Affected

References

https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766
https://github.com/WeblateOrg/wlc/pull/1098
https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.