CVE-2026-15146 Overview
CVE-2026-15146 is a Server-Side Request Forgery (SSRF) vulnerability in GNU Wget. The tool does not validate the IP address returned by an FTP server in the response to a PASV command when operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can direct Wget's data connection to an attacker-chosen IP address and port. This behavior lets an attacker forge requests originating from the host running Wget, reaching localhost services or internal network resources that would otherwise be unreachable from outside.
Critical Impact
Attackers controlling an FTP endpoint or a redirect target can pivot Wget into an SSRF primitive against internal services, exposing management interfaces, cloud metadata endpoints, and other non-public assets.
Affected Products
- GNU Wget (FTP passive mode client functionality)
- Automation, CI/CD, and scripting pipelines that invoke wget against untrusted URLs
- Servers and workstations processing HTTP-to-FTP redirects with Wget
Discovery Timeline
- 2026-07-10 - CVE-2026-15146 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-15146
Vulnerability Analysis
GNU Wget implements the FTP client protocol described in RFC 959, including passive mode. In passive mode the client sends PASV and the server replies with an IP address and port for the data channel. Wget then opens a TCP connection to that address to receive file content or directory listings.
The flaw is that Wget accepts the IP address in the PASV response without checking whether it matches the control connection peer. RFC recommendations and most modern FTP clients enforce that the passive data connection returns to the same host as the control connection. Without this check, the server dictates where Wget connects next.
An attacker leverages this in two ways. First, by hosting a malicious FTP server referenced in a URL passed to Wget. Second, by operating an HTTP server that issues a 3xx redirect to an ftp:// URL under attacker control. Because Wget follows redirects by default, HTTP-originated fetches can be pivoted into arbitrary internal TCP connections.
Root Cause
The root cause is missing input validation on the IP address field of the FTP PASV server response. The client trusts server-supplied network parameters without comparing them to the established control channel peer.
Attack Vector
The attacker returns a crafted PASV reply such as 227 Entering Passive Mode (127,0,0,1,0,80), which encodes 127.0.0.1:80. Wget opens a TCP connection to that endpoint and issues the data-transfer sequence. Internal HTTP services, cloud instance metadata endpoints, or database ports on the Wget host can be reached this way, producing SSRF against systems the attacker cannot address directly. The upstream fix commit 4f85853f641863d5915786a8413e1a213726a62b in the GNU Wget repository adds validation of the address returned by the server. Additional analysis appears in CERT Vulnerability Report #564823.
Detection Methods for CVE-2026-15146
Indicators of Compromise
- Outbound FTP control connections from Wget-invoking hosts followed by data connections to IP addresses that do not match the FTP server's control-channel IP.
- wget process activity opening TCP sockets to 127.0.0.1, RFC 1918 ranges, or cloud metadata addresses such as 169.254.169.254 shortly after an HTTP or FTP fetch.
- HTTP responses with 3xx redirects pointing to ftp:// URLs in proxy or web filtering logs.
Detection Strategies
- Correlate FTP control-channel destinations with subsequent data-channel destinations per Wget process; flag mismatches.
- Monitor for wget command lines targeting external URLs that resolve to hosts issuing redirects to ftp:// schemes.
- Alert on any connection from an automation user or service account to instance metadata IPs or loopback ports immediately following a wget invocation.
Monitoring Recommendations
- Ingest process, command line, and network telemetry from build agents, CI runners, and jump hosts into a centralized data lake for cross-source correlation.
- Baseline expected Wget destinations per host role and alert on deviations, particularly connections to internal management ports.
- Enable egress logging on FTP data ports and treat mixed HTTP-to-FTP redirect chains as high signal for review.
How to Mitigate CVE-2026-15146
Immediate Actions Required
- Inventory hosts and pipelines that run wget against user- or third-party-supplied URLs and prioritize them for patching.
- Upgrade GNU Wget to a version incorporating commit 4f85853f641863d5915786a8413e1a213726a62b, which enforces PASV IP validation.
- Restrict Wget invocations in automation to allowlisted domains and disable automatic protocol downgrades from HTTP to FTP where possible.
Patch Information
The upstream fix is delivered in the GNU Wget commit 4f85853f641863d5915786a8413e1a213726a62b, available at the GNU Wget source repository. Distribution maintainers are expected to backport the change to supported Wget packages. Verify the installed version through the distribution's package manager and rebuild container images that bundle Wget.
Workarounds
- Pass --no-passive-ftp to force active mode when interacting with FTP endpoints, or block the FTP protocol entirely at egress.
- Use --max-redirect=0 or restrict allowed schemes with --protocol-directories and wrapper scripts to prevent HTTP-to-FTP redirect chaining.
- Run wget inside network namespaces or containers with strict egress policies that deny loopback and RFC 1918 destinations.
- Replace wget with curl invocations that explicitly limit protocols using --proto '=https' for untrusted URL processing.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
