VulnSocial

CVE-2026-71495

LOWCVSS 10.0 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 6 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Peaked 1d ago at 4 mentions (2026-11-06); latest day: 2
  • 6 total mentions across 2 days

Deep dive

Activity timeline6 mentions / 2d
01234Mentions · 2026-11-06: 4Mentions · 2026-11-07: 211-0611-07
Referenced assets4 URLs
Full discourse6 posts
  • cve.new@cvedotnew

    CVE-2026-71495 · CRITICAL · CVSS 10.0 Wanderer is a self-hosted trail database for saving and sharing adventures. CVSS 3.1 · GitHub_M https://cve.new/CVE-2026-71495

    0302101.3K
    1.2K followersView on X
  • cve.now@cvedotnow

    🆕 New CVE Wanderer: internal network access via SSRF in trail download (CVE-2026-71495) Remote attackers can read internal services and cloud metadata, scan internal networks, or crash the service. Patch → 0.20.0 https://cve.now/CVE-2026-71495?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical

    020511.4K
    22.4K followersView on X
  • Parameter Watch@ParameterWatch

    🚨 CVE-2026-71495 (10.0) 🚨 Wanderer, the self-hosted trail database, lets anyone make it fetch internal addresses and hand back the response. Versions before 0.20.0 are affected. Upgrade to 0.20.0. https://t.co/CNAStYQ4ZH

    1000045
    21 followersView on X
  • Upwind Security MDR@UpwindMDR

    🚨Critical - Wanderer Unauth SSRF via trail download (CVE-2026-71495) Wanderer’s unauthenticated POST /api/v1/trail/download is SSRF when PUBLIC_PRIVATE_INSTANCE is not set to true: the handler passes attacker-controlled JSON url into event.fetch() and returns the response. Enables access to internal services/cloud metadata, data exposure, recon, and DoS. 👉Affected: open-wanderer/wanderer < 0.20.0 | Upgrade to 0.20.0

    0000050
    389 followersView on X
  • AgentPrime@agentprime_io

    🔴 Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access (CVE-2026-71495) Fix → 0.20.0 https://agentprime.io/advisories/CVE-2026-71495/

    0000048
    2 followersView on X
  • Enclave Radar@EnclaveRadar

    🆕 New CVE: CVE-2026-71495 (CVSS 10.0, Enclave score 8/10) open-wanderer wanderer · Server-side request forgery Remote, no login needed. Wanderer is a self-hosted trail database for saving and sharing adventures. https://app.enclave.ai/threat-feed/CVE-2026-71495

    0000054
    210 followersView on X

Explore more

Back to dashboard