CVE-2026-85675 in OWL
Summary
by MITRE • 09/04/2026
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources, with responses returned to the agent context.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The OWL DocumentProcessingToolkit contains a critical Server-Side Request Forgery vulnerability within its extract_document_content tool, stemming from insufficient input validation and URL parsing logic. This flaw allows an attacker who can control or influence the inputs passed to this function to force the server-side application to fetch arbitrary URLs. The core technical deficiency lies in the absence of rigorous filtering mechanisms for scheme, host, IP address, and port specifications when processing caller-supplied URLs. By leveraging prompt injection techniques, a malicious actor can manipulate the input parameters to bypass any existing naive checks or default behaviors, effectively tricking the server into initiating HTTP requests to internal network resources that are otherwise inaccessible from the public internet.
This vulnerability is classified under CWE-918, which addresses Server-Side Request Forgery (SSRF), and aligns with MITRE ATT&CK technique T1557, specifically Adversary-in-the-Middle or Lateral Tool Transfer if used to pivot through compromised systems. The operational impact of this flaw is severe because it enables unauthorized access to internal services such as metadata endpoints, administrative interfaces, database ports, or cloud instance metadata stores like AWS EC2 169.254.169.254. Since the responses from these fetched URLs are returned directly into the agent context, an attacker can exfiltrate sensitive data, including authentication tokens, internal configuration details, or proprietary business logic contained within private network services. This capability effectively turns the vulnerable application into a proxy for attacking other systems on the same network segment or cloud environment.
The exploitation vector relies heavily on prompt injection, where attackers craft specific text inputs that are interpreted by the underlying AI agent as instructions to modify its own behavior or data processing steps. When combined with the SSRF flaw in extract_document_content, this creates a powerful attack chain. The attacker does not need direct network access to internal services; instead, they leverage the trusted server's outbound connection capabilities. This is particularly dangerous in modern LLM-based applications where user inputs are dynamically processed and can trigger complex backend operations without explicit user awareness of the underlying technical actions being performed.
To mitigate this vulnerability, developers must implement strict allow-listing for URLs permitted by the extract_document_content tool rather than relying on block lists or simple pattern matching that can be easily evaded through encoding tricks or protocol variations such as HTTP versus HTTPS redirections. It is essential to validate both the scheme and the resolved IP address of the target host before initiating any request, ensuring that requests do not resolve to private RFC 1918 addresses, link-local addresses, or loopback interfaces. Additionally, implementing network-level controls such as egress filtering can provide a defense-in-depth layer by restricting outbound connections from the application server to only known and necessary external endpoints. Regular security audits of prompt injection defenses should also be conducted to prevent attackers from manipulating the agent's context window to trigger these SSRF conditions in the first place.