← Back to CVE List
CVE-2026-92719NVD
Vulnerability Summary
Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queue_url to the create-source API to scan internal networks and fingerprint services based on connection response differences.
CVSS v4.0 Base Metrics — Score 8.7 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredNone
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)None
Availability (Vulnerable System)None
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
CVSS v3.1 Base Metrics — Score 7.5 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
Affected & Patched Versions
- quickwit-oss quickwit <= 0.9.0
- quickwit-oss quickwit 0.9.0
External References
- https://github.com/quickwit-oss/quickwit/issues/6703
- https://github.com/quickwit-oss/quickwit
- https://github.com/quickwit-oss/quickwit/blob/v0.9.0/quickwit/quickwit-serve/src/index_api/source_resource.rs#L56-L66
- https://github.com/quickwit-oss/quickwit/blob/v0.9.0/quickwit/quickwit-indexing/src/source/queue_sources/sqs_queue.rs#L230-L243
- https://www.vulncheck.com/advisories/quickwit-through-0.9.0-ssrf-via-sqs-queue-url-parameter