CVE-2026-105746 | docling-project Docling up to 2.130.x OCR Processing kserve_v2_ocr_model.py StandardPdfPipeline._make_ocr_model pipeline_options.enable_remote_services server-side request forgery

October 5, 2026 Yanac

A vulnerability identified as problematic has been detected in docling-project Docling up to 2.130.x. This issue affects the function StandardPdfPipeline._make_ocr_model of the file docling/models/stages/ocr/kserve_v2_ocr_model.py of the component OCR Processing. Performing a manipulation of the argument pipeline_options.enable_remote_services results in server-side request forgery.

This vulnerability is known as CVE-2026-105746. Remote exploitation of the attack is possible. No exploit is available.

You should upgrade the affected component.VulDB Recent EntriesRead More