CVE-2026-51152

CriticalCVSS 9.1

Published: 31/08/2026(UTC)Updated: 01/09/2026(UTC)Translated: 31/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

Server-side request forgery (SSRF) vulnerability in the /har/test endpoint in QD. Fetcher.build_request() constructs an HTTP request from user-supplied data without validating URL scheme, host, or IP range, and the endpoint does not require authentication.

Risk Assessment

An unauthenticated attacker can force the QD server to send requests to internal network resources and cloud metadata endpoints, potentially leading to exposure of sensitive information or further attacks.

Recommendation

Immediately update QD to a version that validates URLs and IP addresses and requires authentication for the /har/test endpoint.

Other vulnerabilities in QD

CVE-2026-51153Medium
Stored Cross-Site Scripting (XSS) vulnerability in TaskRunHandler.post() in web/handlers/task.py in QD. When a task is run via /task/<taskid>/run, task log content is rendered into the HTML response without HTML encoding, allowing a low-privileged attacker to inject malicious script.

Original NVD description (English source)

Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.build_request() in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication, enabling unauthenticated remote attackers to force the QD server to send arbitrary HTTP requests to internal network resources and cloud metadata endpoints. validate_cert is set to False, disabling TLS verification.