Description

Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gradio interface to make the server issue HTTP requests to arbitrary internal addresses including metadata services and read retrieved content through parsed document output.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T20:20:17.510Z",
  "pubdate": "2026-08-28T20:20:17.510Z",
  "executiveSummary": "Qwen-Agent versions through 0.0.34 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability residing within the document parsing utility.\nThe vulnerability originates from inadequate validation of user-supplied paths, which are processed as URLs without enforcing scheme restrictions or host-level validation.\nThis flaw enables unauthenticated remote attackers to force the underlying server to execute arbitrary HTTP requests directed at internal network resources.\nImpact includes potential unauthorized access to sensitive internal services, such as cloud provider metadata endpoints (e.g., 169.254.169.254), and the exfiltration of sensitive information.\nThe data retrieved from these internal requests is subsequently rendered back through the parsed document output, facilitating exfiltration.\nExploitation does not require prior authentication, and the vulnerability is reachable through the exposed Gradio interface.",
  "technicalDetails": "The root cause of this SSRF vulnerability is the improper handling of user-inputted document paths within the Qwen-Agent document parsing pipeline. Specifically, the application logic fails to sanitize or validate input strings before passing them to internal request-handling functions. By treating these paths as generic URLs, the application allows an attacker to supply arbitrary URIs, including those targeting internal network infrastructure.\nThe vulnerability is accessible via the unauthenticated Gradio interface integrated into the Qwen-Agent framework. Because the document parsing component does not implement a restrictive allowlist for protocols (e.g., restricting to file:// or specific HTTPS domains) or hostnames, the server acts as an open proxy for the attacker.\nThe attack flow begins when an attacker provides a crafted payload as a path parameter to the document parsing endpoint. Upon receiving the input, the application initiates an outbound HTTP request directed at the specified URI. If the URI targets an internal resource, the server, operating with the trust credentials of the host machine, performs the request.\nA primary objective for attackers in this scenario involves querying cloud metadata services, which often do not require authentication when accessed from within the environment. By crafting a request to an endpoint like http://169.254.169.254/latest/meta-data/, an attacker can retrieve IAM role credentials, environment variables, or other sensitive infrastructure configurations. Once the internal resource responds, the server processes the payload as a document, effectively reflecting the content of the target internal resource back to the attacker via the standard document parsing output.\nThis vulnerability effectively bypasses traditional network perimeter defenses, as the attack is originated from the trusted internal server environment. There are no authentication or privilege requirements to trigger this functionality, making it a high-risk vector for initial access and information gathering in a compromised environment."
}