At the very least there is an ethical obligation to report.
Standards of Ethical Conduct for Employees of the Executive Branch:
§ 2635.101 Basic obligation of public service.
(b) General principles. The following general principles apply to every employee and may form the basis for the standards contained in this part.
(11) Employees shall disclose waste, fraud, abuse, and corruption to appropriate authorities.
However, there is, apparently, no legal requirement, except for certain individuals. (Note that the following applies to felonies.)
In the article Misprision of felony, specifically:
"Misprision of felony" is still an offense under United States federal law after being codified in 1909 under 18 U.S.C. § 4:
Whoever, having knowledge of the actual commission of a felony cognizable by a court of the United States, conceals and does not as soon as possible make known the same to some judge or other person in civil or military authority under the United States, shall be fined under this title or imprisoned not more than three years, or both.
This offense, however, requires active concealment of a known felony rather than merely failing to report it.
...
The federal misprision of felony statute is usually used only in prosecutions against defendants who have a special duty to report a crime, such as a government official.
It appears that, if the whistleblower is a government official, there is a legal obligation to report; otherwise, no.
Additional information - Employees of the Intelligence Community.
(This relates to matters of urgent concern.)
§ 8H. Additional provisions with respect to Inspectors General of the Intelligence Community
(a)
(1)
(A) An employee of the Defense Intelligence Agency, the National Geospatial-Intelligence Agency, the National Reconnaissance Office, or the National Security Agency, or of a contractor of any of those Agencies, who intends to report to Congress a complaint or information with respect to an urgent concern may report the complaint or information to the Inspector General of the Department of Defense (or designee).
(B) An employee of the Federal Bureau of Investigation, or of a contractor of the Bureau, who intends to report to Congress a complaint or information with respect to an urgent concern may report the complaint or information to the Inspector General of the Department of Justice (or designee).
(C) Any other employee of, or contractor to, an executive agency, or element or unit thereof, determined by the President under section 2302 (a)(2)(C)(ii) of title 5, United States Code, to have as its principal function the conduct of foreign intelligence or counterintelligence activities, who intends to report to Congress a complaint or information with respect to an urgent concern may report the complaint or information to the appropriate Inspector General (or designee) under this Act or section 17 of the Central Intelligence Agency Act of 1949 [50 U.S.C. 403q].
[Emphasis added.]
For employees of the Intelligence Community, reporting is not legally required.