CVE-2026-82268
Qwen-Agent Server-Side Request Forgery via Caller-Supplied Document URL
CVSS 4.0 8.7 HIGHCVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-82268
PublishedQwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gradio interface to make the server issue HTTP requests to arbitrary internal addresses including metadata services and read retrieved content through parsed document output.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-82268 · CVE overview and exploitation status
cve-program · CVE-2026-82268
- https://github.com/QwenLM/Qwen-Agent/issues/913
- https://github.com/QwenLM/Qwen-Agent
- https://github.com/QwenLM/Qwen-Agent/blob/31a4d36d123688581a9e9744427272b33ce940e0/qwen_agent/tools/simple_doc_parser.py
- https://www.vulncheck.com/advisories/qwen-agent-server-side-request-forgery-via-caller-supplied-document-url
Related changes
Linked by CVE identifierNo related changes are available here.