CVE-2021-31879 Information disclosure in n/a

Medium 6.1 Published 29 Apr 2021 Updated 8 Oct 2026

GNU Wget leaks Authorization headers to different origins during redirects, potentially exposing credentials to attackers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-31879?

CVE-2021-31879 is a medium-severity vulnerability in Netapp Cloud Backup, published on 29 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Weakness: CWE-601

Which versions are affected by CVE-2021-31879?

It affects 6 products.

Linux distribution packages (4)

`wget` SUSE:Linux Enterprise Micro 5.5	All versions	`1.20.3-150000.3.29.1`
`wget` SUSE:Linux Enterprise Module for Basesystem 15 SP6	All versions	`1.20.3-150600.19.12.1`
`wget` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	All versions	`1.14-21.22.1`
`wget` openSUSE:Leap 15.6	All versions	`1.20.3-150600.19.12.1`

Products include Broadcom Brocade Fabric Operating System Firmware, Gnu Wget, Netapp 500f Firmware, Netapp A250 Firmware, Netapp Cloud Backup, Netapp Ontap Select Deploy Administration Utility.

How do I fix CVE-2021-31879?

Upgrade to a fixed version.

Is CVE-2021-31879 being exploited?

There is no known exploitation of CVE-2021-31879 in the wild and no public exploit code.

All Netapp Cloud Backup vulnerabilities

Sources

Also known as AZL-6957, CLSA-2026-1778811697, DEBIAN-CVE-2021-31879, GHSA-78qj-768g-464g, JLSEC-2026-118, ROOT-OS-DEBIAN-11-CVE-2021-31879 and 8 more.