SSRF in Open-Wanderer Wanderer

CVE-2026-71495

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.

Vulnerability class: SSRF (Server-Side Request Forgery)

Published .

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-71495?
CVE-2026-71495 is a critical-severity vulnerability in Open-Wanderer Wanderer, classified under Server-Side Request Forgery (SSRF). CVSS score: 10.0/10. Published 2026-11-06.
How severe is CVE-2026-71495?
Critical severity. CVSS v3 base score is 10.0 out of 10.