---
id: "CVE-2026-71495"
page: "https://infrastack.ai/live/CVE-2026-71495"
kind: "vulnerability"
aliases: ["CVE-2026-71495"]
title: "Wanderer: unauthenticated trail download fetches attacker-chosen URLs, exposing internal services"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["docker", "other", "self-hosted", "wanderer"]
not_affected_if: ["public-private-instance-true", "version-0.20.0-or-later"]
published_at: "2026-11-06T19:17:56+00:00"
first_seen_at: "2026-11-06T19:43:49+00:00"
updated_at: "2026-11-06T19:45:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71495", "first_seen_at": "2026-11-06T19:43:49+00:00"}]
exploit_sources: []
---

# Wanderer: unauthenticated trail download fetches attacker-chosen URLs, exposing internal services

Link for people: https://infrastack.ai/live/CVE-2026-71495 (this .md is for agents)

Wanderer, a self-hosted trail database, has an endpoint that fetches any URL supplied in a request and returns the response without requiring login when public-private mode is off. An attacker can use the server to reach internal services and cloud metadata addresses, reading returned data and scanning the internal network.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Wanderer version in use; affected versions are those before `0.20.0`.
- Check whether `PUBLIC_PRIVATE_INSTANCE` is set to `true` in the deployment configuration; if it is not, the endpoint is reachable without login.

## Fix

- Upgrade Wanderer to `0.20.0` or later.

## Timeline

- 2026-11-06T19:43:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-71495

## Documents

- [advisory] Vendor advisory: github.com https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5
- [fix] Patch: github.com https://github.com/open-wanderer/wanderer/commit/c371337b3db1d2895b5cad651046ef0ad4dfc802
- [fix] Release notes: github.com https://github.com/open-wanderer/wanderer/releases/tag/v0.20.0

## From the sources

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_