CVE-2026-71495

Summary

The unauthenticated POST /api/v1/trail/download endpoint in Wanderer prior to v0.20.0 allows SSRF by passing attacker-controlled URLs directly to event.fetch(), enabling access to internal services and metadata endpoints.

Exploitability

Exploitation is trivial for unauthenticated remote attackers; no user interaction or privileges required.

Blast radius

Successful exploitation could expose sensitive internal service data (e.g., database, search), enable internal network reconnaissance, or cause denial of service via crafted requests to critical internal endpoints.

Detection

Defenders should monitor for outbound HTTP/HTTPS requests from the application server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.1), or cloud metadata endpoints (e.g., 169.254.169.254) originating from the /api/v1/trail/download handler; logs may show unexpected external or internal domain resolution and fetch activity.

Prioritized remediation

Upgrade to Wanderer version 0.20.0 or later, which fixes the SSRF vulnerability in the /api/v1/trail/download endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.