CVE-2026-82268: unauth SSRF via document URL parser

CISO Take

Qwen-Agent's document parsing tool accepts caller-supplied paths as URLs without any scheme restriction or host validation, and because the bundled Gradio interface ships unauthenticated by default, any network-reachable attacker can trigger the flaw with zero credentials and zero user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). The practical risk is that an attacker points the parser at cloud metadata endpoints such as 169.254.169.254 or other internal-only services and reads the retrieved content straight back through the document output, effectively turning the AI agent deployment into an internal reconnaissance and credential-harvesting proxy. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this is not an active-exploitation emergency — but SSRF against cloud metadata services is one of the most reliably weaponized bug classes once tooling appears, and the vulnerability requires no authentication or user interaction to reach. Until an upstream fix lands, block or firewall any exposed Qwen-Agent Gradio interface from the internet, restrict the document-parsing tool from reaching internal/link-local address ranges (169.254.0.0/16, RFC1918) at the network layer, and hunt logs for outbound requests to metadata IPs or non-http(s) schemes like file:// or gopher:// originating from the Qwen-Agent host.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

High-severity, low-effort SSRF (CVSS 7.5, AC:L, PR:N, UI:N) with confidentiality-only impact (C:H/I:N/A:N). No active exploitation signal (not in CISA KEV, no SSVC decision, no EPSS score available) and no public PoC or Nuclei template exists yet, which lowers near-term likelihood versus a KEV-listed flaw. However, the combination of an unauthenticated entry point, zero user interaction, and a well-understood exploitation pattern (SSRF to cloud metadata services) means the real-world risk will rise sharply the moment a public PoC circulates. Exposure hinges entirely on whether the Gradio interface is reachable from untrusted networks — internet-facing or flat-internal-network deployments are effectively pre-authenticated for this attack.

How does the attack unfold?

Initial Access

Attacker locates an unauthenticated Qwen-Agent Gradio interface reachable over the network.

AML.T0049

Malicious Tool Invocation

Attacker submits a document-parsing request using a URL pointing at an internal address or cloud metadata endpoint instead of a legitimate document.

AML.T0053

Server-Side Request Forgery

Qwen-Agent's document parser, lacking scheme/host validation, issues the HTTP request from its own network position to the attacker-chosen internal target.

Data Exposure

The internal response content (e.g. metadata credentials, internal service data) is returned to the attacker through the parsed document output.

AML.T0086

Initial Access

Attacker locates an unauthenticated Qwen-Agent Gradio interface reachable over the network.

AML.T0049

Malicious Tool Invocation

Attacker submits a document-parsing request using a URL pointing at an internal address or cloud metadata endpoint instead of a legitimate document.

AML.T0053

Server-Side Request Forgery

Qwen-Agent's document parser, lacking scheme/host validation, issues the HTTP request from its own network position to the attacker-chosen internal target.

Data Exposure

The internal response content (e.g. metadata credentials, internal service data) is returned to the attacker through the parsed document output.

AML.T0086

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Check upstream Qwen-Agent repository/issue #913 for a patched release beyond 0.0.34 and upgrade as soon as one is available. 2) Immediately restrict network exposure of the Gradio interface — bind to localhost, require authentication in front of it via reverse proxy/VPN, or take it offline if not actively needed. 3) At the network layer, block the host running Qwen-Agent from reaching link-local (169.254.0.0/16) and internal RFC1918 ranges unless explicitly required, using egress firewall rules or a network policy (especially critical in cloud environments to block metadata service access). 4) If code-level mitigation is possible before a patch ships, add an allowlist of permitted schemes (http/https only, no file/gopher/ftp) and validate resolved hostnames/IPs against a denylist of internal ranges before the document parser issues any request. 5) Monitor logs/egress traffic for requests to metadata IPs (169.254.169.254, metadata.google.internal) or unexpected internal hosts originating from the Qwen-Agent process.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionData LeakageAgentPluginAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0086- Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7-AI system security and resilience evaluated and documented

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-82268?

Qwen-Agent's document parsing tool accepts caller-supplied paths as URLs without any scheme restriction or host validation, and because the bundled Gradio interface ships unauthenticated by default, any network-reachable attacker can trigger the flaw with zero credentials and zero user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). The practical risk is that an attacker points the parser at cloud metadata endpoints such as 169.254.169.254 or other internal-only services and reads the retrieved content straight back through the document output, effectively turning the AI agent deployment into an internal reconnaissance and credential-harvesting proxy. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this is not an active-exploitation emergency — but SSRF against cloud metadata services is one of the most reliably weaponized bug classes once tooling appears, and the vulnerability requires no authentication or user interaction to reach. Until an upstream fix lands, block or firewall any exposed Qwen-Agent Gradio interface from the internet, restrict the document-parsing tool from reaching internal/link-local address ranges (169.254.0.0/16, RFC1918) at the network layer, and hunt logs for outbound requests to metadata IPs or non-http(s) schemes like file:// or gopher:// originating from the Qwen-Agent host.

Is CVE-2026-82268 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-82268, increasing the risk of exploitation.

How to fix CVE-2026-82268?

1) Check upstream Qwen-Agent repository/issue #913 for a patched release beyond 0.0.34 and upgrade as soon as one is available. 2) Immediately restrict network exposure of the Gradio interface — bind to localhost, require authentication in front of it via reverse proxy/VPN, or take it offline if not actively needed. 3) At the network layer, block the host running Qwen-Agent from reaching link-local (169.254.0.0/16) and internal RFC1918 ranges unless explicitly required, using egress firewall rules or a network policy (especially critical in cloud environments to block metadata service access). 4) If code-level mitigation is possible before a patch ships, add an allowlist of permitted schemes (http/https only, no file/gopher/ftp) and validate resolved hostnames/IPs against a denylist of internal ranges before the document parser issues any request. 5) Monitor logs/egress traffic for requests to metadata IPs (169.254.169.254, metadata.google.internal) or unexpected internal hosts originating from the Qwen-Agent process.

What systems are affected by CVE-2026-82268?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, document ingestion pipelines.

What is the CVSS score for CVE-2026-82268?

CVE-2026-82268 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.48%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesdocument ingestion pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0086Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gradio interface to make the server issue HTTP requests to arbitrary internal addresses including metadata services and read retrieved content through parsed document output.

Exploitation Scenario

An attacker discovers an internet-facing or internally-reachable Qwen-Agent Gradio demo instance (e.g., via search engine dorking or internal network scanning). Without authenticating, they submit a 'document' to be parsed using a URL such as `http://169.254.169.254/latest/meta-data/iam/security-credentials/` instead of a legitimate document link. The Qwen-Agent server, trusting the caller-supplied path as-is, issues the HTTP request from its own network position and hands the response text to its document parsing output. The attacker reads the returned IAM role credentials or other internal service data directly from the agent's response, then uses those credentials to pivot further into the victim's cloud environment.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.