Tencent/WeKnora · error

elasticsearch address failed SSRF validation: %w

Error message

elasticsearch address failed SSRF validation: %w

What it means

createElasticsearchV8Engine wraps utils.ValidateURLForSSRF failure on cc.Addr before any client is created. Elasticsearch endpoints pointing at private/loopback/metadata addresses are refused at runtime, even if the stored row was never input-validated.

Source

Thrown at internal/container/engine_factory.go:193

	cc := store.ConnectionConfig
	// Version-based v7/v8 SDK selection.
	// Version is auto-detected by PR2's TestConnection and saved to connection_config.
	// Empty version defaults to v8 (latest SDK).
	if isESv7(cc.Version) {
		return createElasticsearchV7Engine(store, cfg)
	}
	return createElasticsearchV8Engine(store, cfg)
}

// isESv7 checks if the detected ES version is 7.x.
func isESv7(version string) bool {
	return strings.HasPrefix(version, "7.")
}

func createElasticsearchV8Engine(store types.VectorStore, cfg *config.Config) (interfaces.RetrieveEngineService, error) {
	cc := store.ConnectionConfig
	if err := utils.ValidateURLForSSRF(cc.Addr); err != nil {
		return nil, fmt.Errorf("elasticsearch address failed SSRF validation: %w", err)
	}
	client, err := elasticsearch.NewTypedClient(elasticsearch.Config{
		Addresses: []string{cc.Addr},
		Username:  cc.Username,
		Password:  cc.Password,
		Transport: &utils.SSRFValidatingRoundTripper{
			Base: utils.NewSSRFSafeTransport(utils.DefaultSSRFSafeHTTPClientConfig()),
		},
	})
	if err != nil {
		return nil, fmt.Errorf("create elasticsearch v8 client: %w", err)
	}
	repo := elasticsearchRepoV8.NewElasticsearchEngineRepository(client, cfg, &store.IndexConfig)
	return retriever.NewKVHybridRetrieveEngine(repo, types.ElasticsearchRetrieverEngineType), nil
}

func createElasticsearchV7Engine(store types.VectorStore, cfg *config.Config) (interfaces.RetrieveEngineService, error) {
	cc := store.ConnectionConfig

View on GitHub (pinned to 988cbb0330)

Solutions

1. Point the ES address at an allowed, non-SSRF endpoint
2. Re-save the store through validated create/test flows
3. Review SSRF policy if the address is legitimately required

When it happens

Trigger: Thrown at internal/container/engine_factory.go:193 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/1eea8107bb52e276. Report an issue: GitHub.