{
 "id": "AIR-2026-0095",
 "slug": "cve-2026-82268-qwen-agent-document-parsing-path-server-side",
 "title": "CVE-2026-82268: Qwen-Agent Document Parsing Path Server-Side Request Forgery",
 "summary": "Qwen-Agent contains an SSRF vulnerability in its document parsing path due to treating paths as URLs without proper validation. Attackers can reach internal interfaces and read retrieved content through parser outputs.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Qwen-Agent"
 ],
 "incident_date": "2026-08-28",
 "incident_date_precision": "day",
 "first_reported": "2026-08-28",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82268",
   "publisher": "NVD",
   "title": "CVE-2026-82268: Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats…",
   "published_at": "2026-08-28"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-82268",
  "qwen-agent",
  "ssrf"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}