CVE-2026-105742

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every remote image URL named by an untrusted document when enable_remote_fetch=True and fetch_images=True. The loader does not restrict those credentials to the source document's origin, allowing requests that carry custom headers such as API keys and cookies to follow cross-origin redirects and expose the caller's configured credentials to a document author. The default configuration is not affected because remote fetching and configured headers are required. This issue is fixed in 2.132.0.

• CWE-201
• CWE-522

• https://github.com/docling-project/docling/commit/5e469137f275ffc443306a30d12a3a45bceb80fb
• https://github.com/docling-project/docling/pull/4420
• https://github.com/docling-project/docling/releases/tag/v2.132.0
• https://github.com/docling-project/docling/security/advisories/GHSA-p3fw-7699-7926
• https://github.com/docling-project/docling/security/advisories/GHSA-p3fw-7699-7926

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105708A flaw has been found in imgproxy up to 4.0.17. Affected by …4.3
• CVE-2026-10571IBM WebSphere Application Server - Liberty 17.0.0.3 through …5.3
• CVE-2026-105712gpgtar in GnuPG before 2.5.19 can allow file overwrite via c…3.6
• CVE-2026-10573A denial-of-service security issue exists in 1734 POINT I/O™…6.3
• CVE-2026-105740Langflow is a tool for building and deploying AI-powered age…9.9
• CVE-2026-105741Langflow is a tool for building and deploying AI-powered age…7.1
• CVE-2026-105743Docling simplifies document processing by parsing diverse fo…4
• CVE-2026-105744Docling simplifies document processing by parsing diverse fo…7.5
• CVE-2026-105745Docling simplifies document processing by parsing diverse fo…6.7
• CVE-2026-105746Docling simplifies document processing by parsing diverse fo…2.2
• CVE-2026-105747Docling simplifies document processing by parsing diverse fo…4.3
• CVE-2026-105748Docling simplifies document processing by parsing diverse fo…4.3