CVE-2026-51152: QD SSRF Vulnerability in /har/test Endpoint

CVE-2026-51152 Overview

CVE-2026-51152 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the QD task management platform. The flaw affects QD versions 20220208 through 20250803 and resides in the /har/test endpoint. The Fetcher.build_request() function in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. Because the handler requires no authentication, remote attackers can force the QD server to issue arbitrary HTTP requests to internal network resources and cloud metadata endpoints. TLS verification is also disabled through validate_cert=False.

Critical Impact
Unauthenticated remote attackers can pivot into internal networks and exfiltrate cloud instance credentials from metadata services such as 169.254.169.254.

Affected Products

QD task management platform, version 20220208
QD task management platform, versions between 20220208 and 20250803
QD task management platform, version 20250803

Discovery Timeline

2026-08-31 - CVE-2026-51152 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51152

Vulnerability Analysis

The vulnerability [CWE-918] resides in the QD HTTP Archive (HAR) testing feature. The /har/test handler accepts JSON input describing an HTTP request and passes it directly to Fetcher.build_request(). That function instantiates a Tornado httpclient.HTTPRequest object using the caller-controlled URL, method, headers, and body. No allowlist, denylist, or scheme filter is applied before the request executes.

An attacker can specify URLs targeting loopback interfaces, RFC1918 addresses, or cloud metadata services. The QD server then performs the request on the attacker's behalf and returns the response body, exposing internal-only services to unauthenticated remote users. Setting validate_cert=False additionally allows the server to complete TLS connections to hosts presenting invalid or self-signed certificates, expanding the reachable attack surface.

Root Cause

The root cause is missing input validation on the URL parameter passed into Fetcher.build_request(). The function trusts user input for scheme, host, and IP address selection. The /har/test route also lacks the authentication decorator applied to other administrative endpoints in QD.

Attack Vector

An attacker sends a crafted HTTP POST request to /har/test on any exposed QD instance. The JSON payload targets internal URLs such as http://127.0.0.1:8080/admin or http://169.254.169.254/latest/meta-data/iam/security-credentials/. The QD server returns the fetched content, enabling internal port scanning, service enumeration, and theft of temporary IAM credentials from AWS, GCP, or Azure metadata endpoints. Refer to the GitHub Gist PoC Script for technical exploitation details.

Detection Methods for CVE-2026-51152

Indicators of Compromise

Inbound HTTP requests to /har/test from untrusted networks, particularly with JSON bodies containing internal IP ranges or metadata service hostnames.
Outbound requests from the QD server process to 169.254.169.254, metadata.google.internal, or RFC1918 addresses not part of normal operation.
QD application logs showing Fetcher.build_request() invocations with unusual URL destinations.

Detection Strategies

Deploy web application firewall rules that inspect POST bodies to /har/test and block payloads referencing loopback, link-local, or private IP ranges.
Correlate QD process network telemetry with the endpoint under attack to surface anomalous egress patterns.
Alert on any successful HTTP response returned by QD that references cloud metadata JSON schemas or IAM credential fields.

Monitoring Recommendations

Enable verbose access logging on the QD reverse proxy and forward events to a centralized SIEM for retention and correlation.
Monitor for authentication-less access patterns to administrative endpoints across the QD deployment.
Track cloud audit logs for use of instance role credentials from unexpected source IP addresses following suspicious /har/test activity.

How to Mitigate CVE-2026-51152

Immediate Actions Required

Restrict network access to QD administrative endpoints, especially /har/test, using firewall rules or reverse proxy allowlists.
Block QD server egress to cloud metadata endpoints such as 169.254.169.254 and internal management subnets.
On AWS, enforce Instance Metadata Service Version 2 (IMDSv2) with hop limit 1 to prevent SSRF-based credential theft.

Patch Information

No vendor patch is referenced in the CVE record at publication time. Review the QD-Today Security Blog for upstream fix availability and upgrade guidance before deploying any release later than 20250803.

Workarounds

Place QD behind an authenticating reverse proxy and require valid credentials for all routes including /har/test.
Deploy egress filtering on the QD host to allow only explicitly required outbound destinations.
Run QD inside a network namespace or container without routes to internal management networks or cloud metadata services.

bash

# Example nginx configuration to block unauthenticated access to /har/test
location /har/test {
    allow 10.0.0.0/8;
    deny all;
    auth_basic "QD Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://qd_backend;
}