Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-82268

Qwen-Agent Server-Side Request Forgery via Caller-Supplied Document URL

CVSS 4.0 8.7 HIGHCVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-82268

Published

Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gradio interface to make the server issue HTTP requests to arbitrary internal addresses including metadata services and read retrieved content through parsed document output.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-82268

Published

qwen-agent

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "QwenLM",
                    "product": "Qwen-Agent",
                    "versions": [
                        {
                            "version": "0",
                            "lessThanOrEqual": "0.0.34",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "packageName": "qwen-agent"
                }

Original source record · Cite this exact observation · Complete original publisher JSON