CVE-2026-1858CWE-20
wget2 Improper Certificate Validation
Medium · published April 29, 2026
What it is
wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
The record
Technical detail
- CVSS v3.1
- 4.8 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00155 · 4.3th percentile
- Weakness
- CWE-20 · Improper Input Validation
- Published
- 2026-04-29T20:15Z
EPSS history
Timeline