CVE-2026-39845 Weblate: SSRF via the webhook add-on using unprotected fetch_url()

Medium 4.1 Published 15 Apr 2026 Updated 15 Apr 2026

Attackers can exploit the webhook add-on to perform Server-Side Request Forgery, potentially accessing internal resources or bypassing security controls.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-39845?

CVE-2026-39845 is a medium-severity server-side request forgery vulnerability in WeblateOrg weblate, published on 15 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.

Weakness: CWE-918

Which versions are affected by CVE-2026-39845?

3 open source packages ship an affected version, including weblate and Weblate. It affects 1 product.

Package	Affected	Fixed in
`weblate` PyPI	All versions	`5.17`
`weblate` PyPI	All versions	`5.17`
`Weblate` PyPI	All versions	`5.17`

Products include Weblate Weblate.

How do I fix CVE-2026-39845?

Upgrade weblate to 5.17 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-39845 being exploited?

There is no known exploitation of CVE-2026-39845 in the wild and no public exploit code.

Sources

Also known as GHSA-f8hv-g549-hwg2, PYSEC-2026-156.