CVE-2026-105746

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kserve_v2_ocr_model.py sends page images to its configured endpoint without checking the pipeline_options.enable_remote_services setting, even when the caller sets that policy control to false. The StandardPdfPipeline._make_ocr_model method also fails to pass the flag into the OCR factory, allowing remote OCR processing in configurations that rely on remote services being disabled. The destination is configured by the caller rather than selected by an attacker. This issue is fixed in 2.131.0.

• CWE-668
• CWE-693

• https://github.com/docling-project/docling/commit/7d6d0c4810dff4885017c53890be6dc5a22ca68b
• https://github.com/docling-project/docling/pull/4418
• https://github.com/docling-project/docling/releases/tag/v2.131.0
• https://github.com/docling-project/docling/security/advisories/GHSA-h42j-9hcc-3cwc

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105740Langflow is a tool for building and deploying AI-powered age…9.9
• CVE-2026-105741Langflow is a tool for building and deploying AI-powered age…7.1
• CVE-2026-105742Docling simplifies document processing by parsing diverse fo…3.7
• CVE-2026-105743Docling simplifies document processing by parsing diverse fo…4
• CVE-2026-105744Docling simplifies document processing by parsing diverse fo…7.5
• CVE-2026-105745Docling simplifies document processing by parsing diverse fo…6.7
• CVE-2026-105747Docling simplifies document processing by parsing diverse fo…4.3
• CVE-2026-105748Docling simplifies document processing by parsing diverse fo…4.3
• CVE-2026-105749Docling simplifies document processing by parsing diverse fo…6.5
• CVE-2026-10575IBM MQ could allow an authenticated attacker to cause a deni…8.8
• CVE-2026-105750Docling simplifies document processing by parsing diverse fo…5.9
• CVE-2026-105751Docling simplifies document processing by parsing diverse fo…6.9