CVE-2026-51152

Deferred Deferred - Pending Action

SSRF in QD Server via Unauthenticated /har/test Endpoint

Publication date: 2026-08-31

Last updated on: 2026-09-01

Assigner: MITRE

Description

Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.build_request() in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication, enabling unauthenticated remote attackers to force the QD server to send arbitrary HTTP requests to internal network resources and cloud metadata endpoints. validate_cert is set to False, disabling TLS verification.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-09-01

Generated

2026-09-20

AI Q&A

2026-08-31

EPSS Evaluated

2026-09-15

NVD

CVE-2026-51152

EUVD

EUVD-2026-68648

Affected Vendors & Products

Vendor	Product	Version / Range
qd	qd	From 20220208 (inc) to 20250803 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the /har/test endpoint of QD software versions 20220208 through 20250803. The flaw allows unauthenticated remote attackers to force the server to send arbitrary HTTP requests to internal networks or cloud metadata endpoints by exploiting improper URL validation in the Fetcher.build_request() function.

Detection Guidance

Check for unusual outbound HTTP requests from your QD server, especially to internal or cloud metadata endpoints. Monitor logs for requests to the /har/test endpoint without authentication. Use network traffic analysis tools like tcpdump or Wireshark to inspect outbound connections from the QD server process.

Impact Analysis

An attacker could exploit this to access internal systems, exfiltrate sensitive data, or interact with cloud provider metadata services. Since TLS verification is disabled, attackers may also intercept or manipulate traffic. The lack of authentication requirements means any remote user can launch attacks.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection (GDPR) and healthcare (HIPAA) due to unauthorized access to internal systems and potential data breaches. It undermines security controls for protecting sensitive data and could result in regulatory penalties.

Mitigation Strategies

Disable the /har/test endpoint if not needed. Implement strict URL validation in libs/fetcher.py to restrict allowed schemes, hosts, and IP ranges. Require authentication for the /har/test endpoint. Enable TLS verification by setting validate_cert to True in HTTPRequest construction.

Hi! I’m here to help you understand CVE-2026-51152. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70