CVE-2026-71495

Name of the Vulnerable Software and Affected Versions Wanderer versions prior to 0.20.0

Description When the PUBLIC PRIVATE INSTANCE variable is not set to true, the unauthenticated POST '/api/v1/trail/download' endpoint passes the attacker-controlled url field in the JSON body directly to the event.fetch() function and returns the response. This allows unauthorized requests to internal services, such as 'db:8090' and 'search:7700', cloud metadata addresses, and other network destinations, which can lead to data exposure, internal network reconnaissance, or denial of service.

Recommendations Update to version 0.20.0.