CVE-2026-82268: Qwen-Agent SSRF Vulnerability

CVE-2026-82268 Overview

CVE-2026-82268 is a server-side request forgery (SSRF) vulnerability in Qwen-Agent through version 0.0.34. The document parsing path treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers reach the unauthenticated Gradio interface and coerce the server into issuing HTTP requests to arbitrary internal addresses. Reachable targets include cloud metadata services and internal HTTP endpoints. The parsed document output returns retrieved content back to the attacker, turning the flaw into an information disclosure primitive. The weakness is tracked under CWE-918.

Critical Impact
Unauthenticated attackers can pivot into internal networks and exfiltrate cloud metadata, including short-lived credentials from IMDS endpoints.

Affected Products

Qwen-Agent through 0.0.34
Deployments exposing the Qwen-Agent Gradio interface
Applications importing qwen_agent/tools/simple_doc_parser.py

Discovery Timeline

2026-08-28 - CVE-2026-82268 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82268

Vulnerability Analysis

Qwen-Agent exposes a document parser designed to ingest local files and remote documents for downstream language model tasks. The parser accepts a caller-supplied path argument and routes it through URL fetching logic without validating the URL scheme or destination host. When the surrounding application publishes a Gradio interface without authentication, any network-reachable client can invoke the parser.

The fetch routine issues an outbound HTTP request from the server, then extracts textual content from the response and returns it in the tool output. This gives attackers a read primitive against arbitrary internal HTTP resources reachable from the Qwen-Agent host. In cloud deployments, this includes the AWS, Azure, and GCP instance metadata services, which routinely expose temporary credentials and configuration data.

Root Cause

The root cause is missing validation in the document parsing path. Caller-supplied values are treated as URLs without a scheme allowlist, without host validation, and without blocking loopback, link-local, or private RFC1918 ranges. The unauthenticated Gradio interface removes any authentication barrier in front of the vulnerable code.

Attack Vector

A network-adjacent attacker submits a crafted document reference through the Gradio interface. The reference points to an internal target such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. The Qwen-Agent process fetches the URL and parses the response body. The parsed content, including any credentials or sensitive metadata, is returned to the attacker through the standard tool response channel. Refer to the VulnCheck SSRF Advisory and the Simple Doc Parser source for the affected code path.

Detection Methods for CVE-2026-82268

Indicators of Compromise

Outbound HTTP requests from the Qwen-Agent host to 169.254.169.254, metadata.google.internal, or 169.254.169.254/metadata/instance Azure endpoints.
Unexpected internal HTTP fetches originating from the Qwen-Agent process to RFC1918 or loopback addresses.
Gradio access logs containing document parsing requests with http://, https://, file://, or gopher:// schemes pointing to internal hosts.

Detection Strategies

Inspect application logs for simple_doc_parser invocations where the path value resolves to internal or link-local addresses.
Correlate Gradio HTTP request logs with outbound network flows from the same process to identify SSRF pivots.
Baseline expected document sources and alert on parser calls referencing unexpected schemes or hostnames.

Monitoring Recommendations

Forward Qwen-Agent stdout, Gradio access logs, and host network telemetry to a centralized analytics pipeline.
Monitor egress to cloud metadata IPs from any workload that hosts Qwen-Agent and alert on non-zero volume.
Track IAM credential usage from Qwen-Agent instance roles and flag credential use from unexpected source IPs.

How to Mitigate CVE-2026-82268

Immediate Actions Required

Remove public exposure of the Qwen-Agent Gradio interface and require authentication in front of it.
Block egress from Qwen-Agent hosts to cloud metadata IPs and internal management ranges at the network layer.
Enforce IMDSv2 with hop-limit 1 on AWS instances hosting Qwen-Agent to defeat SSRF-based credential theft.
Rotate any IAM credentials, API keys, or secrets reachable from the Qwen-Agent host if exposure is suspected.

Patch Information

No fixed version is identified in the NVD entry at time of publication. Track the Qwen-Agent repository and GitHub Issue #913 for upstream remediation. Until a fix ships, treat all Qwen-Agent deployments through version 0.0.34 as vulnerable.

Workarounds

Wrap the simple_doc_parser tool to allowlist schemes (http, https only) and reject hostnames that resolve to loopback, link-local, or RFC1918 ranges.
Route parser HTTP requests through an egress proxy that enforces destination allowlists and blocks metadata endpoints.
Run Qwen-Agent in a network segment without direct access to cloud metadata services or internal admin planes.
Disable the document parsing tool entirely when it is not required by the deployed agent workflow.

bash

# Example iptables rule blocking AWS IMDS from the Qwen-Agent host
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Example nginx reverse proxy enforcing auth in front of Gradio
location / {
    auth_basic "Qwen-Agent";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://127.0.0.1:7860;
}