CVE-2026-15146 is an SSRF vulnerability in GNU Wget where the software does not validate the IP address returned by an FTP PASV response in passive mode. This flaw enables a malicious FTP server or an HTTP server redirecting to FTP to redirect Wget's data connection to any IP address and port specified by the attacker. The vulnerability allows attackers to forge server-side requests from the Wget host, potentially accessing internal or localhost services that are otherwise inaccessible externally.

The vulnerability can be exploited to make Wget connect to arbitrary internal or localhost network services, potentially exposing sensitive internal resources or services. This could lead to unauthorized information disclosure or further internal network compromise depending on the services accessible via the forged requests.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/564823 for current remediation guidance. Until a fix is available, avoid using Wget to retrieve content from untrusted FTP servers or HTTP servers that redirect to FTP URLs. Consider alternative tools or methods that do not exhibit this behavior.