CVE-2026-92719: Quickwit through 0.9.0 SSRF via SQS queue_url Parameter
Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and fingerprint services based on connection response differences.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker who can submit a malicious queue_url through Quickwit's create-source API can trigger requests from the Quickwit node. The supplied data does not state that authentication or other privileges are required.
What systems are exposed to the resulting requests?
Internal addresses reachable from the Quickwit node may be contacted. An attacker can use differences in connection responses to scan internal networks and fingerprint services.
What input should be restricted as an immediate mitigation?
Restrict access to the create-source API and prevent untrusted users from supplying SQS file-source queue_url values. Validate or allowlist the queue_url scheme and host so it cannot target arbitrary internal addresses.
Which versions are identified as affected?
Quickwit through version 0.9.0 is identified as affected.