External risk intelligence

Server-Side Request Forgery in QD /har/test Endpoint

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-51152

The vulnerability exists in an unauthenticated endpoint (/har/test) of a web application designed to fetch and process requests. As a web-based service endpoint that processes external input without authentication, it is commonly exposed to the internet to perform its intended function of testing or fetching resources, making the attack surface readily reachable.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the QD server's testing endpoint. It allows unauthenticated attackers to make the server send arbitrary HTTP requests to internal systems or cloud resources, potentially leading to unauthorized access or data exposure. The primary concern is to confirm if this specific functionality is used within your environment and whether it's exposed externally.

Unauthenticated attackers can force server requests.
Matters if internal resources are exposed externally.
Confirm relevance and confirm exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending specially crafted JSON data to the `/har/test` endpoint. This allows them to trick the QD server into making arbitrary HTTP requests to internal network resources or cloud metadata endpoints, potentially exposing sensitive information or internal systems. The server's TLS certificate verification is also disabled, further aiding the attacker.

No authentication required.
Sends arbitrary HTTP requests.
Exposes internal resources and metadata.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability allows unauthenticated attackers to trick the QD server into sending arbitrary HTTP requests to internal network resources and cloud metadata endpoints. This is possible because the affected component constructs HTTP requests from user-supplied JSON without properly validating the URL scheme, host, or IP range, and it disables TLS certificate verification.

Internal network resources and cloud metadata.
Forcing server to make arbitrary HTTP requests.
Unauthorized access to sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical Server-Side Request Forgery vulnerability in the /har/test endpoint affects unauthenticated users, allowing them to force the QD server to make arbitrary HTTP requests to internal resources or cloud metadata endpoints. The first practical move is to identify all instances of the affected QD technology, confirm their exposure and criticality, and then locate the accountable owner to plan remediation based on risk.

Application owners must prioritize remediation.
Verify unauthenticated endpoint exposure.
Plan risk-based remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is QD and why is it used?

QD is a software platform designed to handle HTTP request testing and resource fetching. Organizations typically deploy it to facilitate automated verification of network services or external web resources. The component involved, libs/fetcher.py, manages the construction of these outbound requests.

What does CVE-2026-51152 mean for security?

This vulnerability is classified as Server-Side Request Forgery (CWE-918). It occurs because the software fails to check the destination URL or IP address provided in user input before attempting to connect to it. Essentially, it allows an attacker to manipulate the server into acting as a proxy, forcing it to send requests to locations it should not be able to reach.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending malicious JSON data to the /har/test endpoint. Because this endpoint requires no authentication, anyone with network access to the server can initiate these requests. It is important to note that sending standard, non-JSON requests or targeting unrelated endpoints will not trigger the specific logic flaw found in the fetcher component.

Is my QD instance at risk of exploitation?

According to Halo Surface Signal, instances that are internet-facing are at higher risk because the /har/test endpoint does not require authentication and is reachable by anyone online. If your QD server is strictly internal and disconnected from the internet, the risk profile changes, though unauthorized internal actors could still potentially interact with the vulnerable endpoint.

What should I do to secure my environment?

First, inventory your systems to locate all active QD installations. Verify whether these instances are accessible from the internet. Once located, coordinate with the system owners to assess the risk and discuss plans for disabling the /har/test endpoint or applying necessary vendor updates as they become available to remediate the request forgery.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.