CVE-2026-71495: Critical SSRF in Wanderer

Wanderer is a self-hosted trail database for saving and sharing adventures. CVE-2026-71495 affects the POST /api/v1/trail/download endpoint: when PUBLIC_PRIVATE_INSTANCE is not set to true, the handler accepts an attacker-controlled url field and passes it directly to event.fetch(), allowing requests to any network destination. This exposes internal services such as database (db:8090) and search engine (search:7700), as well as cloud metadata endpoints and other internal resources.

The vulnerability is classified CVSS 10.0 (Critical) and requires no authentication: anyone accessing the compromised endpoint can query the organization's internal services. The main danger lies in the exposure of sensitive data from internal services and the ability to perform internal network reconnaissance, plus potential denial of service attacks. The flaw was disclosed on November 6, 2026, and signals on public platforms confirm the spread of information over the last 24 hours.

Top priority: update Wanderer to version 0.20.0 or later where the vulnerability is patched. For instances that cannot be updated in the short term, verify that PUBLIC_PRIVATE_INSTANCE is set to true to disable the public endpoint. Check access logs for suspicious activity on the /api/v1/trail/download endpoint. Monitor internal services (database, search engine) for anomalous access. Document which version of Wanderer is in use and schedule the update as an urgent intervention.