CVE-2026-105746 in Docling
Summary
by MITRE • 10/06/2026
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kserve_v2_ocr_model.py sends page images to its configured endpoint without checking the pipeline_options.enable_remote_services setting, even when the caller sets that policy control to false. The StandardPdfPipeline._make_ocr_model method also fails to pass the flag into the OCR factory, allowing remote OCR processing in configurations that rely on remote services being disabled. The destination is configured by the caller rather than selected by an attacker. This issue is fixed in 2.131.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified within Docling versions ranging from 2.83.0 to 2.131.0 represents a critical failure in enforcing security policies regarding remote service interactions during document processing operations. Docling is designed as a comprehensive tool for parsing diverse document formats and integrating with generative AI ecosystems, which inherently involves handling sensitive data such as scanned documents containing personal or proprietary information. The core of the vulnerability lies in the KServeV2OcrModel class located within the docling/models/stages/ocr/kserve_v2_ocr_model.py module. This component is responsible for sending page images extracted from documents to a configured external endpoint for Optical Character Recognition processing. However, it fails to respect the pipeline_options.enable_remote_services configuration flag when this setting is explicitly set to false by the caller or administrator.
This lack of enforcement creates a significant bypass mechanism where security controls intended to restrict network egress are effectively neutralized. The StandardPdfPipeline._make_ocr_model method further exacerbates this issue by failing to propagate the enable_remote_services flag into the OCR factory logic. Consequently, even in configurations that explicitly rely on remote services being disabled for compliance or data sovereignty reasons, the system proceeds with remote OCR processing. This behavior indicates a fundamental disconnect between policy definition and operational execution within the application's architecture. The vulnerability allows an attacker who can influence document input to trigger unauthorized network connections, potentially leading to data exfiltration if the external endpoint is maliciously controlled or monitored by third parties.
From a technical classification perspective, this flaw aligns with CWE-20 Improper Input Validation and CWE-941 Incorrect Enforcement of Behavioral Constraints. The application accepts configuration inputs but fails to enforce them consistently across all code paths involved in resource initialization. In the context of the MITRE ATT&CK framework, this vulnerability facilitates Initial Access or Exfiltration over C2 channels depending on how the remote endpoint is utilized by an adversary. While the destination for these requests is configured by the caller rather than directly selected by an attacker through injection, the ability to force outbound connections against policy enables potential data leakage and violates strict network segmentation strategies often required in enterprise environments.
The operational impact of this vulnerability extends beyond simple privacy concerns. In regulated industries such as finance or healthcare, where documents containing protected health information or financial records are processed locally for compliance with standards like HIPAA or GDPR, the unauthorized transmission of page images to external services constitutes a direct violation of data handling protocols. Furthermore, if the remote OCR service is compromised or becomes unavailable, it could introduce availability issues or serve as an attack vector for supply chain compromises through the third-party service provider. The reliance on external endpoints without proper validation also increases the attack surface by introducing dependencies that are not subject to the same security controls as the local processing environment.
This issue has been addressed in version 2.131.0 of Docling, where the code paths have been corrected to ensure that the enable_remote_services flag is properly checked and enforced before initiating any remote OCR requests. Administrators and developers using versions prior to this fix should immediately upgrade their dependencies to mitigate the risk of unauthorized data transmission. Until an update can be applied, organizations relying on these older versions must implement strict network-level controls such as firewall rules or egress filtering to block outbound traffic from the application server to any external OCR endpoints. Additionally, code reviews and static analysis tools should be employed to detect similar patterns where configuration flags are ignored during object initialization in other parts of the codebase to prevent analogous vulnerabilities in related modules.