CVE-2022-26146

This vulnerability is a “stored script” problem: someone who can log in to qTest can save a malicious script inside a place that other people will later view. When other users open that page, the script runs in their browser, which can let an attacker impersonate users or steal information those users can access—similar to hiding a prank inside a note that triggers every time others read it.

This matters if you run Tricentis qTest and have users who can create or modify content inside it. Because the attacker must already be authenticated, the risk is mainly about what “logged-in” access looks like in your business (for example, contractors, low-trust accounts, or overly broad permissions). This is only a risk when the attacker can log in and inject content that others will view.

Treat this as medium urgency (Amber): it has clear real-world abuse potential because it enables stored script execution that targets other users. Public proof-of-concept exists, but there is no indication from the provided findings that it’s been widely exploited in the wild, so the priority is to upgrade before an internal or compromised account is used.

1. Confirm exposure
   • Log into your Tricentis qTest admin area (or check your qTest installation/version documentation) and record the exact qTest version.
   • If the version is before 10.4, you are in scope.
2. Confirm affected behavior (lightweight checks)
   • Review recent changes to content created by users (e.g., new/updated items that render in a browser) and look for suspicious unusual markup or unexpected changes.
   • If you have a staging environment, test by verifying that content rendering properly escapes/handles user input after upgrading (specific testing steps depend on your qTest configuration).
3. Upgrade to the fixed version
   • Upgrade qtest to 10.4. The provided vendor fix indicates: qtest is fixed in 10.4.
   • If your organization has multiple qTest environments (dev/test/prod), upgrade in this order: dev → test → prod.
   • Check release notes for any operational or configuration changes required by 10.4.
4. Temporary workaround if patching is delayed
   • Reduce the number of accounts that can create or edit content that others view.
   • For higher-risk accounts, temporarily restrict or suspend content-editing permissions until you complete the upgrade.
   • Increase review of user-created content changes and investigate anything unusual.
5. After upgrade
   • Re-check the qTest version to confirm it is exactly 10.4.
   • Continue monitoring for suspicious content creation patterns for a short period after the upgrade.
6. KEV / guidance timing
   • KEV (CISA) listing was not found in the provided findings, so there is no specific CISA deadline included here.

Severity is rated as medium (CVSS 5.4). This is stored cross-site scripting (CWE-79): an authenticated attacker can inject malicious script into qTest content; the script is stored and later executed in other users’ browsers when they view the affected content. The findings indicate low privileges are sufficient because authentication is required but the authorization level is not clearly described (findings note “Low”). Exploitation maturity: public PoC exists (1 known), but no KEV listing was provided and there’s no confirmed wide exploitation in the findings. EPSS is predicted at 0.4% with a flat trend, but this should not be used to dismiss the risk given the stored nature and user-to-user impact. KEV meaning here: no inclusion was found, so there’s no CISA-verified exploitation timeline from KEV in the provided data.