CVE-2026-51152: SSRF
Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest() in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication, enabling unauthenticated remote attackers to force the QD server to send arbitrary HTTP requests to internal network resources and cloud metadata endpoints. validatecert is set to False, disabling TLS verification.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Require authentication for the /har/test endpoint to prevent unauthenticated remote attackers from forcing SSRF requests.
QD /har/test endpoint Authentication requirement = required - Configuration
Enable TLS certificate verification by setting validate_cert to True instead of False in the HTTPRequest construction to prevent accepting unverified TLS connections.
Fetcher.build_request() / libs/fetcher.py validate_cert = True - Configuration
Add validation in Fetcher.build_request() for user-supplied JSON before constructing httpclient.HTTPRequest: validate the URL scheme, restrict allowed hosts, and enforce allowed IP ranges to prevent SSRF (validate URL scheme, host, and IP range).
Fetcher.build_request() / libs/fetcher.py HTTP request destination validation = enabled (scheme, host, and IP range validation)
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker who can reach the QD server's unauthenticated /har/test endpoint can exploit it. No account or prior authentication is required.
What access can an attacker gain through the vulnerable endpoint?
An attacker can cause the QD server to make arbitrary HTTP requests, including requests to internal network resources and cloud metadata endpoints reachable from the server.
Are HTTPS requests protected from interception or certificate validation failures?
No. The request construction sets validate_cert to False, so TLS certificate verification is disabled for requests made through the endpoint.
Which QD releases are identified as affected?
The affected range is QD 20220208 through 20250803.