CVE-2026-92719 is a server-side request forgery in Quickwit through version 0.9.0. The create-source API accepts a queue address for SQS file sources without checking its host or scheme, so the node can be made to contact internal addresses. NVD scores it High (7.5). We could not confirm a fixed version.
What's affected
The NVD record lists Quickwit through 0.9.0 as affected. The weakness is CWE-918, server-side request forgery. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N: no login, network reachable, confidentiality impact only.
The public issue on the project's tracker says the create-source REST endpoint uses the queue address verbatim as the endpoint of its SQS client, and that a connectivity check on creation makes a request to whatever host and port was supplied. It adds that the default open source deployment has no authentication on the REST API, and that error messages reflect something about the response. That is why an outsider can learn about internal hosts from the differences in responses.
We found no release that fixes it. Check the Quickwit repository and its issue tracker for the current status.
How to check if you're exposed
Check your Quickwit version against 0.9.0. Then check who can reach the REST API. If it is open on a network that untrusted people or systems can reach, the no-login vector applies in full.
If the node runs in a cloud environment, also think about what internal addresses it can reach, such as management interfaces or instance metadata services. Those are the typical targets for this class of flaw.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Put the Quickwit REST API behind authentication or a gateway, and block access from untrusted networks.
- Limit the node's outbound network access to the services it needs, so internal probing returns nothing useful.
- On cloud hosts, require the more protective version of the instance metadata service where your provider offers one.
- Watch the project repository for a fix and upgrade when it arrives.
- Review logs for source creation requests you did not make.
Why it matters
A server-side request forgery turns a feature that talks to a remote service into a probe. The attacker supplies the address and the server, sitting inside your network, makes the connection. Differences in the response, such as refused or timed out, reveal which hosts and ports exist.
The score here reflects confidentiality only: no data is changed and nothing crashes. The value for an attacker is a map of internal services and a base for further attacks. The remedy in code is to allow only expected hosts and schemes. The KEV flag in the record is false and no source we read reports exploitation.
Quick check
Does this need an account?
Not in the default open source setup, according to the public issue, which says the REST API has no authentication there.
Is there a fix?
We could not confirm one. Check the repository.
Sources
Last reviewed: 18 October 2026.
