CVE-2026-51152: n/a

This vulnerability (CVE-2026-51152) affects QD software versions from 20220208 through 20250803. The /har/test endpoint uses Fetcher.build_request() to create HTTP requests based on user input without validating critical parameters such as URL scheme, host, or IP range. Because this endpoint is unauthenticated, remote attackers can exploit it to perform SSRF attacks, forcing the server to send arbitrary HTTP requests to internal or cloud metadata services. The lack of TLS verification (validate_cert=False) further weakens security by disabling certificate validation. The CVSS v3.1 score is 9.1 (critical), reflecting the ease of exploitation (network attack vector, no privileges or user interaction required) and the high impact on confidentiality and integrity.

An unauthenticated remote attacker can exploit this SSRF vulnerability to make the QD server send arbitrary HTTP requests to internal network resources and cloud metadata endpoints. This can lead to unauthorized access to sensitive internal services, potential leakage of confidential data, and compromise of cloud instance metadata. The disabled TLS verification increases the risk of man-in-the-middle attacks during these requests. The vulnerability does not directly impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /har/test endpoint and implement network-level controls to prevent the server from making unauthorized requests to internal or cloud metadata IP ranges. Monitor for unusual outbound requests from the server. Avoid exposing this endpoint publicly if possible.