Tencent/WeKnora · error

vector store engine %q has no SSRF address policy

Error message

vector store engine %q has no SSRF address policy

What it means

validateRuntimeVectorStoreAddresses default case: the engine type has an SSRF policy for every known network engine, so reaching default means an engine type with network endpoints was added without updating this validator. It is a completeness guard, not a data error.

Source

Thrown at internal/container/engine_factory.go:128

	case types.ElasticsearchRetrieverEngineType,
		types.OpenSearchRetrieverEngineType,
		types.MilvusRetrieverEngineType,
		types.TencentVectorDBRetrieverEngineType,
		types.DorisRetrieverEngineType:
		return check("vector store address", cc.Addr)
	case types.QdrantRetrieverEngineType:
		endpoint := cc.Host
		if endpoint != "" && cc.Port != 0 {
			endpoint = net.JoinHostPort(strings.Trim(cc.Host, "[]"), strconv.Itoa(cc.Port))
		}
		return check("qdrant address", endpoint)
	case types.WeaviateRetrieverEngineType:
		if err := check("weaviate HTTP address", cc.Host); err != nil {
			return err
		}
		return check("weaviate gRPC address", cc.GrpcAddress)
	default:
		return fmt.Errorf("vector store engine %q has no SSRF address policy", store.EngineType)
	}
}

// createOpenSearchEngine builds an OpenSearch k-NN retrieve engine. Mirrors
// createElasticsearchV8Engine but uses the driver's TLS-hardened client
// constructor and injects the audit sink. NewRepository probes the cluster
// (version + k-NN plugin), so an unreachable cluster fails here at
// registration rather than on first query.
func createOpenSearchEngine(
	ctx context.Context, store types.VectorStore, auditSink openSearchRepo.AuditSink,
) (interfaces.RetrieveEngineService, error) {
	client, err := openSearchRepo.NewOpenSearchClient(&store.ConnectionConfig)
	if err != nil {
		return nil, fmt.Errorf("create opensearch client: %w", err)
	}
	// Env stores share the cluster without a per-store index prefix; DB stores
	// fold their (>=16-char) ID into the index name. NewRepository enforces the
	// length rule, so map env-store IDs to "".

View on GitHub (pinned to 988cbb0330)

Solutions

1. Add an address-policy case for the new engine type in the validator
2. Verify the engine type is actually network-bound before adding
3. Fail closed — do not bypass the SSRF check

When it happens

Trigger: Thrown at internal/container/engine_factory.go:128 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/a0ed2292eedfc1a2. Report an issue: GitHub.