The vulnerability arises when the KServeV2OcrModel class sends page images to a configured OCR endpoint without verifying the pipeline_options.enable_remote_services flag, even if the caller has set that flag to false. This bypass means that the OCR request will still be sent to the external endpoint specified by the caller. The flaw does not provide an attacker with arbitrary execution capability, but it does allow the Docling instance to transmit page content to a remote service chosen by the configuration. Based on the description, it is inferred that this could enable unintentional data exposure to services outside the trusted environment.

The issue affects the docling-project:docling and docling-slim packages in releases from 2.83.0 up to but not including 2.131.0. Users of these packages who rely on the KServe v2 OCR engine are potentially impacted and should confirm their installed versions.

The CVSS score of 2.2 classifies the vulnerability as low severity. The EPSS score of 0.0022 indicates a very low but nonzero probability of exploitation, and the flaw is not listed in CISA's KEV catalog, indicating limited exploitation data. Because the destination URL is supplied by the calling application, an attacker cannot arbitrarily target an external host; however, a misconfigured system that points to an untrusted OCR endpoint could allow the page images to be sent to that external location. Based on the description, it is inferred that the likely attack vector is a system misconfiguration rather than an active exploit. The overall risk appears low in most environments, but organizations should verify that OCR endpoints are trusted.