CVE-2026-71495 · Other
NO FIX YET · SEE WHAT TO DO
Wanderer, a self-hosted trail database, has an endpoint that fetches any URL supplied in a request and returns the response without requiring login when public-private mode is off. An attacker can use the server to reach internal services and cloud metadata addresses, reading returned data and scanning the internal network.
first public Sep 28, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted Wanderer instances below 0.20.0 where PUBLIC_PRIVATE_INSTANCE is not set to true are exposed, since the POST /api/v1/trail/download handler then needs no authentication. Instances on a private network with the endpoint unreachable from outside carry less risk, but the server can still reach internal services, so the internal network exposure remains. Instances already on 0.20.0 or later are not affected.
Not affected if public-private-instance-true, version-0.20.0-or-later
Who cares docker, self-hosted, wanderer
0.20.0.PUBLIC_PRIVATE_INSTANCE is set to true in the deployment configuration; if it is not, the endpoint is reachable without login.0.20.0 or later.Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.