CVE-2026-51152

CVE-2026-51152 is a critical server-side request forgery (SSRF, CWE-918) in QD builds dated 20220208 through 20250803, in the /har/test endpoint, which requires no authentication. The handler's Fetcher.build_request() in libs/fetcher.py converts attacker-supplied JSON directly into a Tornado httpclient.HTTPRequest without validating the URL scheme, host, or IP range, and sets validate_cert to False, disabling TLS verification on the outgoing request. An unauthenticated remote attacker can therefore force the QD server to send arbitrary HTTP requests to internal network services and cloud metadata endpoints, potentially harvesting internal data or metadata credentials, and the disabled TLS verification additionally exposes those requests to interception. Anyone running an affected QD build is affected, with the highest risk for instances reachable from the internet or hosted where instance-metadata or internal services are accessible. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known; EPSS estimates only a 0.4% chance of exploitation within 30 days.

What to do: Upgrade to a QD release newer than 20250803, which falls outside the affected range. Until you can upgrade, restrict or add authentication to /har/test at a reverse proxy or firewall, avoid exposing QD directly to the internet, and apply egress/metadata filtering (e.g., blocking 169.254.169.254) to limit what the SSRF can reach. Review access and server logs for unauthenticated requests to /har/test followed by unexpected outbound connections to internal hosts or metadata endpoints.