CVE-2026-82268

Qwen-Agent through 0.0.34 contains a server-side request forgery flaw (CWE-918) in its document parsing path, where caller-supplied paths are treated as URLs without scheme restriction or host validation. An unauthenticated attacker who can reach the bundled Gradio interface can trigger the server to issue HTTP requests to arbitrary internal addresses, including cloud metadata services. Retrieved content is returned through parsed document output, giving the attacker read access to internal services and, on cloud-hosted servers, potentially instance metadata. Any deployment running Qwen-Agent 0.0.34 or earlier with the Gradio interface exposed to untrusted networks is affected; purely local or tightly firewalled deployments are largely out of reach. No public proof-of-concept or known exploitation has been reported (EPSS 0.3%, not in CISA KEV).

What to do: Upgrade to a Qwen-Agent release newer than 0.0.34 (no specific fixed version is named in this advisory, so check the project's releases for the SSRF fix). Until patched, restrict the Gradio interface to trusted networks or put it behind authentication, and consider blocking server-side requests to link-local metadata addresses such as 169.254.169.254 and to internal IP ranges. Review logs for unexpected outbound HTTP requests originating from the document parser.