CVE-2026-1858

wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.

Score

CVSS 3.1 4.8 Medium

Status

Analyzed - vulnreport@tenable.com

Published

2026-04-29

Last modified

2026-10-26

Weaknesses

CWE-20

Affected products

• Wget2 (Gnu)

References

• https://www.tenable.com/security/research/tra-2026-37