---
id: CVE-2026-22251
aliases:
  - GHSA-9rp8-h4g8-8766
  - PYSEC-2026-2052
title: Weblate wlc has insecure API key configuration
summary: Weblate wlc has insecure API key configuration
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N'
vendor: wlc
product: wlc
ecosystem: pip
affected:
  - wlc < 1.17.0
patched:
  - wlc 1.17.0
published: '2026-01-12'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-9rp8-h4g8-8766'
references:
  - url: 'https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-22251'
  - url: 'https://github.com/WeblateOrg/wlc/pull/1098'
  - url: >-
      https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797
  - url: 'https://github.com/WeblateOrg/wlc'
tags:
  - osv
  - pip
epss: 0.00191
epssPercentile: 0.07837
ingestedAt: '2026-07-08T18:25:48.079Z'
---

## Overview

### Impact
Historically, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be used against different server.

### Patches
* https://github.com/WeblateOrg/wlc/pull/1098

### Workarounds
Remove unscoped `key` from wlc configuration. Only use URL-scoped keys in the `[keys]` sections.

### References
This issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.

## Affected packages

- `wlc < 1.17.0`

## Remediation

Upgrade to a patched release:

- `wlc 1.17.0`