Cpe:2.3:a:quickwit:quickwit:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aquickwitquickwit/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 16 Sep 2026 19:52:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSSRF Vulnerability in Quickwit SQS File Sourcehttps://feed.craftedsignal.io/briefs/2026-09-quickwit-ssrf/Wed, 16 Sep 2026 19:52:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-quickwit-ssrf/Quickwit versions through 0.9.0 contain a Server-Side Request Forgery vulnerability allowing unauthenticated attackers to perform internal network scanning and service fingerprinting via the create-source API.Quickwit versions through 0.9.0 are affected by a Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-92719. The issue resides in the handling of the queue_url parameter within SQS file sources. The application fails to properly validate the host and scheme components of this parameter when processing requests via the create-source API. This flaw allows an unauthenticated attacker to force the Quickwit node to perform outbound requests to arbitrary internal IP addresses or domains. By analyzing the differential responses from the node, attackers can map internal infrastructure, perform port scanning, and fingerprint internal services that are not directly accessible from the internet. This vulnerability is particularly critical for deployments where the Quickwit instance resides within an internal network segment with access to sensitive management interfaces or other microservices.

Impact

The successful exploitation of CVE-2026-92719 enables unauthorized network reconnaissance within the host environment. By leveraging the Quickwit node as a proxy, attackers can bypass network access controls to interact with internal services. This leads to the exposure of internal service versions, identification of reachable assets, and potential precursor activity for further exploitation of internal-only APIs.

Recommendation

  1. Upgrade all instances of Quickwit to a version beyond 0.9.0 immediately to apply the patch for CVE-2026-92719.
  2. Implement strict network egress filtering on all Quickwit nodes to limit connections to known-good SQS service endpoints.
  3. Monitor webserver access logs for anomalous requests to the create-source API containing non-standard or internal URL schemes (e.g., file://, gopher://) or local IP ranges within the queue_url parameter.
  4. Ensure that the service account running the Quickwit process follows the principle of least privilege, restricting its ability to communicate with internal network segments.
]]>highadvisoryssrfvulnerabilityweb-application