The vulnerability is a server‑side request forgery in the /har/test endpoint of QD versions 20220208 through 20250803. A user‑supplied JSON payload is used to build an HTTP request without validating the scheme, host, or IP range, and TLS verification is disabled. Because the endpoint does not require authentication, any unauthenticated remote user can compel the QD server to send arbitrary HTTP requests to internal network resources or cloud metadata endpoints, potentially exposing sensitive data or enabling further internal attacks.

All installations of QD that include the vulnerable /har/test endpoint, specifically software releases from 20220208 up to and including 20250803.

Though EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, the lack of authentication and input validation implies a low attack‑cost scenario. Attackers can readily target the open endpoint to query internal infrastructure or cloud metadata, making the risk significant. The vulnerability is mapped to CWE‑918, indicating a server‑side request forgery weakness.