This is not a CQWP issue, but a general security tightening of SP2010.
To mitigate this security threat they are not allowed to be opened in browser by default.
Yes you can disable this in two ways, the more secure and the less secure way. Please consider the threat issue and make an educated decision calculating the risk, instead of just blindly saying "we will never get a malicious PDF".
The less secure way to turn it off is setting browser file handling to Permissive. This works for all file types, so basicly any file type is treated the same.
The more secure way (the one i recommend) is to add the PDF mime-type to AllowedInlineDownloadedMimeTypes on the web application. You can do this in PowerShell:
$app = Get-SPWebApplication http://myWebApp
Again make sure you understand the security implications of what you are doing. The most secure way of handling this is to keep the default setting, thus not allowing XSS to exploit your current session.
Shout-out to Maurice Prather for this great article on the subject.