CVE-2026-92719 Quickwit through 0.9.0 SSRF via SQS queue_url Parameter

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

EUVD-2026-80902

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

CVE-2026-92719

Quickwit through 0.9.0 is affected by a Server-Side Request Forgery (SSRF) vulnerability in its SQS file sources . The root cause is a failure to validate the host and scheme of the queue_url parameter, allowing an unauthenticated attacker to supply a malicious value via the create-source API and...

PT-2026-93882

Name of the Vulnerable Software and Affected Versions Quickwit versions prior to 0.9.1 Description Insufficient validation of the host and scheme in the queue url parameter within SQS file sources allows an attacker to force the node to send requests to arbitrary internal addresses. By providing ...