CVE-2026-92719
Last modified
CVE-2026-92719 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queue_url to the create-source API to scan internal networks and fingerprint services based on connection response differences..
Description
Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queue_url to the create-source API to scan internal networks and fingerprint services based on connection response differences.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| quickwit-oss | quickwit | <= 0.9.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-92719?
How severe is CVE-2026-92719?
How do I fix CVE-2026-92719?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92708Svelte devalue is a JavaScript library that serializes value…7.5
- CVE-2026-9271Vulnerability Title5.9
- CVE-2026-92714The Download Manager plugin for WordPress is vulnerable to I…6.5
- CVE-2026-92716Shuffle through 2.2.1 contains a cross-tenant privilege esca…9.6
- CVE-2026-92717Covenant through 0.6 registers the CovenantHub SignalR hub w…9.1
- CVE-2026-92718Nuclei versions before 3.11.1 cache template signature verif…7.3
- CVE-2026-9272In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5,…8.1
- CVE-2026-92720Kubero through 3.1.1 fails to apply authentication guards to…9.1
- CVE-2026-92729SigNoz versions 0.88.0 through 0.141.0 fail to apply authori…8.2
- CVE-2026-9273The Membership Plugin – Kadence Memberships plugin for WordP…9.3
- CVE-2026-9274This vulnerability exists in CP Plus Wi-Fi Camera due to imp…5.2
- CVE-2026-92745A flaw was found in cockpit-machines. This vulnerability all…5
Are you affected by CVE-2026-92719?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST