AIKIDO-2026-495097

TL;DR

Weblate validates a repository hostname's DNS resolution when a component repository URL is saved, but the external Git and other VCS clients perform their own DNS lookup when connecting. A user allowed to manage repository URLs can supply a hostname that first resolves to a public address and later resolves to a private or internal address, bypassing the validation. Protected VCS operations such as clone, fetch, or push can then reach internal VCS-compatible services and expose private repository contents. The fix binds protected Git HTTPS and SSH operations to the addresses approved during validation and disables transports that cannot enforce that binding.