CVE-2026-51152

What it is

Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.build_request() in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication, enabling unauthenticated remote attackers to force the QD server to send arbitrary HTTP requests to internal network resources and cloud metadata endpoints. validate_cert is set to False, disabling TLS verification.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data exposure, data tampering.

Exploit odds

0.7% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-08-31 16:18 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-01 14:17 UTC Last updatedMost recent change to the record

Details

Published

2026-08-31 16:18 UTC

Last modified

2026-09-01 14:17 UTC

Exploit probability

0.7% · EPSS, next 30 days

Weakness

CWE-918 · Server-side request forgery

Record status

Deferred

Attack profile CVSS 3.1 · 9.1

Attack vector

Network

Complexity

Low

Privileges needed

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None