CVE-2026-82268: Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats

Qwen-Agent versions up to 0.0.34 have a server-side request forgery vulnerability (SSRF, where an attacker tricks a server into making requests to unintended locations) in its document parsing feature that doesn't check where file paths actually point to. Attackers can access an unprotected Gradio interface (a tool for building AI demos) to make the server request data from internal systems, like metadata services, and then read that data through the parsed document output.