Qwen-Agent CVE-2026-82268

Exploitation requires that the Gradio interface be network-reachable by the attacker - either directly internet-exposed or accessible from an attacker-controlled internal segment. No authentication is required on the Gradio interface, and no non-default configuration or privileged setup is needed beyond a standard Qwen-Agent deployment. For the SSRF to yield sensitive data, the server must have network access to internal resources such as cloud metadata services or internal APIs; in isolated environments without such internal reachability, exploitability is significantly reduced. Exploitation is limited to confidentiality impact - no write or code-execution primitive is provided by this flaw in isolation. Deployments where the Gradio interface is firewalled exclusively to trusted hosts are not directly exploitable remotely.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) accurately reflects the threat model: no authentication, no special preconditions, and a network-accessible trigger via Gradio's default unauthenticated configuration. The primary real-world risk is credential theft through cloud metadata service access - retrieving an AWS IMDSv1 token yields temporary IAM credentials that can pivot to broader cloud resource enumeration and exfiltration. This SSRF-to-metadata attack pattern is well-understood and frequently exploited in cloud penetration testing engagements, raising confidence that the attack path is practically viable. While no public exploit code has been confirmed and the CVE does not appear in the CISA KEV catalog at time of analysis, the zero-barrier exploitation path warrants urgent remediation for internet-exposed deployments. EPSS data is absent from the provided intelligence, so probabilistic exploitation likelihood cannot be quantified numerically. Risk is substantially reduced for deployments where the Gradio interface is restricted to private network segments, as network reachability is the sole prerequisite for exploitation.

An attacker identifies an internet-accessible Qwen-Agent Gradio interface and submits a document parsing request with the path set to http://169.254.169.254/latest/meta-data/iam/security-credentials/, receiving the instance's IAM role name in the parsed output. A second request to the role-specific credential endpoint retrieves a temporary AWS AccessKeyId, SecretAccessKey, and SessionToken, which the attacker uses to authenticate to the AWS API and begin enumerating or exfiltrating cloud resources. No exploit code is publicly confirmed, but the attack requires only standard HTTP requests and knowledge of cloud metadata endpoint paths.