SSRF Vulnerability in Qwen-Agent Document Parsing

Qwen-Agent, an open-source agent framework, contains a server-side request forgery (SSRF) vulnerability identified as CVE-2026-82268 affecting versions through 0.0.34. The flaw exists within the document parsing functionality, which fails to adequately validate or restrict caller-supplied paths. Specifically, the application processes these paths as URLs without enforcing scheme restrictions or host validation. An unauthenticated attacker can exploit this behavior by manipulating the document parsing input to interact with the server's local environment, including internal Gradio interfaces or cloud-provider metadata services. This enables the attacker to force the server to issue arbitrary HTTP requests and potentially read returned data, which is subsequently surfaced through the application's document parsing output. This vulnerability presents a high risk for environments where Qwen-Agent is deployed with access to internal network resources or sensitive cloud service endpoints.

Impact

Successful exploitation allows unauthenticated attackers to bypass network boundaries and interact with internal services that are not exposed to the public internet. This can lead to the exfiltration of sensitive information, such as cloud metadata, internal configuration details, or credentials, which may facilitate further compromise of the underlying infrastructure or internal services.

Recommendation

• Upgrade to a version of Qwen-Agent that addresses CVE-2026-82268 once available.
• Restrict network access for servers hosting Qwen-Agent to prevent them from reaching internal metadata services (e.g., 169.254.169.254) or sensitive administrative endpoints.
• Implement strict input validation on all document parsing paths to ensure only expected URLs or local file paths are processed.