Executive brief
Quickwit, a cloud-native search engine for observability, fails to properly validate the host and scheme parameters in SQS file sources. An attacker can supply a malicious queue_url to the create-source API, causing the Quickwit node to send requests to arbitrary internal network addresses. This allows attackers to perform network reconnaissance, scan internal services, and fingerprint applications without proper authorization.
Technical details
The vulnerability is an insufficient input validation flaw in the SQS queue source handler where the queue_url parameter does not validate the host and scheme components. An attacker can craft a malicious queue_url parameter and submit it via the create-source API endpoint, which will cause the Quickwit node to issue HTTP requests to arbitrary internal IP addresses and services. The vulnerability requires network access to the create-source API but does not require authentication (depending on Quickwit's deployment security model). An attacker can achieve network reconnaissance and service fingerprinting to identify internal systems for further exploitation. Patches for versions after 0.9.0 are expected to include proper URL scheme and host validation.
Affected products
- Quickwit Quickwit through 0.9.0
Timeline
- 2026-09-16: disclosed