Remote Service Configuration Flaw in Docling by Docling Project
CVE-2026-105746

2.2LOW

Key Information:

Vendor

Docling-project

Status
Docling
Docling-slim
Vendor
CVE Published:
5 October 2026

What is CVE-2026-105746?

A significant vulnerability exists in Docling's KServeV2OcrModel class, which processes images without properly enforcing remote service settings. This oversight allows remote OCR processing to occur even when the configuration disables such services, leading to potential security exposures. Implementing updates in version 2.131.0 addresses this issue, ensuring that the pipeline options are respected.

Affected Version(s)

docling >= 2.83.0, < 2.131.0

docling-slim >= 2.83.0, < 2.131.0

References

https://github.com/docling-project/docling/security/advis...
x_refsource_CONFIRM
https://github.com/docling-project/docling/pull/4418
x_refsource_MISC
https://github.com/docling-project/docling/commit/7d6d0c4...
x_refsource_MISC

CVSS V3.1

Score:
2.2
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.