CVE-2026-105746: Docling: KServe v2 OCR engine does not enforce enable_remote_services
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kservev2ocrmodel.py sends page images to its configured endpoint without checking the pipelineoptions.enableremoteservices setting, even when the caller sets that policy control to false. The StandardPdfPipeline.makeocrmodel method also fails to pass the flag into the OCR factory, allowing remote OCR processing in configurations that rely on remote services being disabled. The destination is configured by the caller rather than selected by an attacker. This issue is fixed in 2.131.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Doclingto a version that resolves this vulnerability.Fixed in 2.131.0
Event History
Frequently Asked Questions
Which deployments are exposed to unintended remote OCR processing?
Docling versions from 2.83.0 up to, but not including, 2.131.0 are affected when they use the KServe v2 OCR model. Configurations that set pipeline_options.enable_remote_services to false are still exposed if this OCR path is configured.
What must an attacker control to exploit this issue?
The remote OCR endpoint is configured by the caller and is not selected by an attacker. The issue causes page images to be sent to that configured endpoint despite the disabled-remote-services policy setting.
What is the recommended remediation?
Upgrade Docling to version 2.131.0, which fixes the missing enforcement of enable_remote_services and passes the setting into the OCR factory.