CVE-2026-92719: Quickwit SSRF Vulnerability in SQS Sources

CVE-2026-92719 Overview

CVE-2026-92719 is a Server-Side Request Forgery (SSRF) vulnerability in Quickwit through version 0.9.0. The flaw affects the SQS file source integration, where the queue_url parameter is not validated for host or scheme. Attackers who can reach the create-source API can supply a crafted queue_url that forces the Quickwit node to issue requests to arbitrary internal addresses. This enables internal network reconnaissance and service fingerprinting based on differences in connection responses. The weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated network-adjacent attackers can pivot through a Quickwit node to probe internal services and disclose sensitive infrastructure metadata.

Affected Products

Quickwit search engine, all versions through 0.9.0
Deployments exposing the Quickwit create-source API to untrusted clients
Nodes configured to accept SQS file sources with user-supplied queue_url values

Discovery Timeline

2026-09-16 - CVE-2026-92719 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92719

Vulnerability Analysis

Quickwit accepts an SQS file source definition through the create-source API endpoint. The source configuration includes a queue_url field that Quickwit uses to construct outbound HTTP requests when polling the queue. The service does not enforce an allowlist on the URL host or scheme before dispatching those requests. As a result, the indexer node connects to whatever endpoint the caller supplies, including 127.0.0.1, RFC1918 ranges, cloud metadata services, and non-SQS ports. Response differences such as status codes, timing, and connection resets allow attackers to map internal infrastructure and identify listening services from outside the trust boundary.

Root Cause

The root cause is missing input validation on the queue_url parameter in the SQS source handler. Relevant code paths in the Quickwit repository (quickwit-indexing/src/source/queue_sources/sqs_queue.rs and quickwit-serve/src/index_api/source_resource.rs) build an AWS SDK client from the caller-provided URL without verifying that the host matches an expected SQS endpoint or that the scheme is restricted to https. See the Vulncheck advisory and Quickwit issue #6703 for the technical breakdown.

Attack Vector

An attacker sends a POST request to the create-source API and supplies a queue_url pointing to an internal target such as http://169.254.169.254/latest/meta-data/ or an internal service on a private IP. Quickwit then issues an outbound HTTP request to that target from the indexer node. The attacker infers service presence, port state, and application identity from the response body, status code, or connection behavior returned by the API. No authentication material for the internal target is required, since exploitation abuses the trust granted to the Quickwit node itself.

// No verified proof-of-concept code is published for CVE-2026-92719.
// Refer to the Vulncheck advisory and Quickwit issue #6703 linked above
// for the technical description of the request flow.

Detection Methods for CVE-2026-92719

Indicators of Compromise

Outbound HTTP requests from Quickwit indexer nodes to non-AWS destinations, especially loopback, RFC1918, or link-local addresses such as 169.254.169.254.
create-source API calls containing queue_url values whose host is not an sqs.<region>.amazonaws.com endpoint.
Unexpected DNS lookups originating from Quickwit hosts for internal service names.

Detection Strategies

Inspect Quickwit application logs for source creation events and alert when the queue_url scheme is not https or the host is not an approved SQS domain.
Correlate audit logs of the create-source API with egress network flows to detect requests to internal IP ranges immediately following source creation.
Deploy egress firewall telemetry that flags Quickwit worker processes contacting metadata services or internal management ports.

Monitoring Recommendations

Forward Quickwit access logs and host-level network telemetry into a centralized analytics platform for retrospective hunting.
Baseline normal queue_url values in each environment and alert on new hosts introduced through the API.
Monitor for scan-like patterns from Quickwit nodes, such as sequential connection attempts across multiple internal ports.

How to Mitigate CVE-2026-92719

Immediate Actions Required

Restrict access to the Quickwit create-source API to trusted operators via network ACLs, authenticated proxies, or a management VPN.
Block egress from Quickwit nodes to internal management ranges and cloud metadata endpoints such as 169.254.169.254.
Audit existing sources and remove any SQS source whose queue_url does not point to a legitimate AWS SQS endpoint.

Patch Information

At the time of publication, no fixed release is listed in NVD for versions after Quickwit 0.9.0. Track the upstream fix through the Quickwit GitHub repository and issue #6703 for remediation progress. Apply the vendor patch as soon as it is released and rotate any cloud credentials that may have been exposed through the indexer node.

Workarounds

Enforce an allowlist of SQS hostnames (sqs.<region>.amazonaws.com) at a reverse proxy in front of the Quickwit API.
Run Quickwit in a network segment with strict egress filtering that permits only required AWS service endpoints.
Disable the SQS source type entirely if it is not used, and require configuration changes to be made through infrastructure-as-code rather than the runtime API.

bash

# Example egress restriction using iptables to block link-local metadata access
iptables -A OUTPUT -m owner --uid-owner quickwit -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner quickwit -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner quickwit -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner quickwit -d 192.168.0.0/16 -j REJECT