Description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every remote image URL named by an untrusted document when enable_remote_fetch=True and fetch_images=True. The loader does not restrict those credentials to the source document's origin, allowing requests that carry custom headers such as API keys and cookies to follow cross-origin redirects and expose the caller's configured credentials to a document author. The default configuration is not affected because remote fetching and configured headers are required. This issue is fixed in 2.132.0.
Published: 2026-10-05
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Credential Exposure
Action: Upgrade
AI Analysis

Impact

Docling includes an image loader that, when remote fetching is enabled, forwards HTTP headers specified in the backend options to every external image request. If an attacker supplies a document with remote image URLs, the loader will transmit custom headers—such as API keys or cookies—across domain boundaries, potentially exposing the caller's credentials to the document author. The weakness is a form of sensitive data exposure (CWE-201) and insufficiently protected credentials (CWE-522).

Affected Systems

The vulnerability affects the docling-project:docling and docling-project:docling-slim packages in versions from 2.95.0 up to and including 2.132.0. The default configuration is not impacted because both enable_remote_fetch and fetch_images must be true for the issue to manifest. The problem was addressed and fixed in release 2.132.0.

Risk and Exploitability

The assigned CVSS score of 3.7 classifies the flaw as low severity. No EPSS score is available, and the issue is not listed in CISA's KEV. Exploitation requires an untrusted document to trigger remote fetching with custom headers; if satisfied, the caller's credentials can be leaked to the document author. The fix in 2.132.0 removes this behavior.

Generated by OpenCVE AI on October 5, 2026 at 22:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade docling to version 2.132.0 or newer.
  • If upgrading is not immediately possible, disable remote fetch or remove custom headers from HTMLBackendOptions.headers when enable_remote_fetch is true and fetch_images is enabled.
  • Monitor and audit documents for external image URLs to ensure the vulnerability is not exploited.

Generated by OpenCVE AI on October 5, 2026 at 22:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-p3fw-7699-7926 Docling: Configured HTTP headers sent to every remote image host named by a document
History

Wed, 07 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Docling
Docling docling
CPEs cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*
Vendors & Products Docling
Docling docling

Tue, 06 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Mon, 05 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Docling-project
Docling-project docling
Vendors & Products Docling-project
Docling-project docling

Mon, 05 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every remote image URL named by an untrusted document when enable_remote_fetch=True and fetch_images=True. The loader does not restrict those credentials to the source document's origin, allowing requests that carry custom headers such as API keys and cookies to follow cross-origin redirects and expose the caller's configured credentials to a document author. The default configuration is not affected because remote fetching and configured headers are required. This issue is fixed in 2.132.0.
Title Docling: Configured HTTP headers sent to every remote image host named by a document
Weaknesses CWE-201
CWE-522
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Docling Docling
Docling-project Docling
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-06T13:55:17.719Z

Reserved: 2026-10-05T19:11:07.946Z

Link: CVE-2026-105742

cve-icon Vulnrichment

Updated: 2026-10-06T13:55:08.621Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-05T22:16:56.867

Modified: 2026-10-07T19:52:37.513

Link: CVE-2026-105742

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-05T21:21:43Z

Links: CVE-2026-105742 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-05T22:45:18Z

Weaknesses
  • CWE-201

    Insertion of Sensitive Information Into Sent Data

  • CWE-522

    Insufficiently Protected Credentials