CVE-2026-92719

Quickwit through 0.9.0 is vulnerable to server-side request forgery (CWE-918) because it does not validate the host or scheme of the queue_url parameter used by SQS file sources. An attacker who can reach the create-source API submits a malicious queue_url, causing the Quickwit node to issue requests to arbitrary attacker-chosen internal addresses; the CVSS 4.0 score of 8.7 reflects network exploitation with no privileges or user interaction required. By observing connection response differences (success, failure, timing, error messages), the attacker can scan internal networks and fingerprint internal services, potentially including sensitive targets such as cloud metadata endpoints. Any Quickwit deployment running version 0.9.0 or earlier whose REST API is reachable by untrusted clients is affected, particularly self-hosted clusters exposed beyond trusted networks. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known.

What to do: Restrict access to the Quickwit REST API (default port 7280) to trusted networks and enforce authentication, and audit existing sources for queue_url values pointing at unexpected hosts or schemes. Where possible, block Quickwit node egress to cloud metadata services (e.g., 169.254.169.254) and internal RFC1918 ranges. No fixed release beyond 0.9.0 is identified in the available data, so upgrade to a patched version once published and treat the create-source API as untrusted input until then.