CVE-2026-82268

Name of the Vulnerable Software and Affected Versions Qwen-Agent versions prior to 0.0.35

Description A server-side request forgery (SSRF) issue exists in the document parsing path. The system treats paths provided by the caller as URLs without validating the host or restricting the scheme. This allows unauthenticated users via the Gradio interface to force the server to send HTTP requests to arbitrary internal addresses, such as metadata services, and retrieve the content through the parsed document output.

Recommendations Update Qwen-Agent to version 0.0.35 or later.