Server-Side Request Forgery in Quickwit Affects Internal Network Security

CVE-2026-92719

What is CVE-2026-92719?

The Quickwit product versions up to 0.9.0 are susceptible to a Server-Side Request Forgery vulnerability in which the application fails to properly validate the host and scheme of the queue_url parameter. This flaw allows attackers to craft malicious queue_url requests through the create-source API, enabling them to perform network scans and discern internal services by analyzing the differences in connection responses. The potential for unauthorized access to internal resources presents significant security risks for organizations relying on Quickwit.

References