Executive brief
Qwen-Agent is an AI agent framework used to build applications on the Qwen language model. A flaw in its document parsing feature allows unauthenticated attackers to make the server issue HTTP requests to arbitrary internal addresses (including cloud metadata services), potentially exposing sensitive configuration, credentials, and internal service data. An attacker can retrieve this content through the parsed document output.
Technical details
A server-side request forgery (SSRF) vulnerability exists in Qwen-Agent's document parsing path (simple_doc_parser.py), where caller-supplied file paths are treated as URLs without scheme restriction or host validation. The unauthenticated Gradio interface exposes this functionality, allowing network-accessible attackers to pass arbitrary URLs (including internal IP addresses and metadata service endpoints such as 169.254.169.254) to trigger outbound HTTP requests. The server parses the retrieved content and returns it in the response, enabling attackers to read sensitive data from internal services and cloud metadata APIs. The vulnerability affects Qwen-Agent versions through 0.0.34.
Affected products
- Alibaba Qwen-Agent through 0.0.34
Timeline
- 2026-08-28: disclosed