The vulnerability is a server‑side request forgery in the /har/test endpoint of QD versions 20220208 through 20250803. A user‑supplied JSON payload is used to build an HTTP request without validating the scheme, host, or IP range, and TLS verification is disabled. Because the endpoint does not require authentication, any unauthenticated remote user can compel the QD server to send arbitrary HTTP requests to internal network resources or cloud metadata endpoints, potentially exposing sensitive data or enabling further internal attacks.

All installations of QD that include the vulnerable /har/test endpoint, specifically software releases from 20220208 up to and including 20250803.

Although the EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, the lack of authentication and input validation means an unauthenticated attacker can easily target the open endpoint to query internal infrastructure or cloud metadata. The CVSS score of 9.1 indicates a high severity vulnerability, and the mapping to CWE‑918 confirms a server‑side request forgery weakness that could expose sensitive data or enable further internal attacks.