CVE-2026-85675: OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources, with responses returned to the agent context.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of OWL DocumentProcessingToolkit that make the extract_document_content tool available are exposed when it can process attacker-influenced URLs, including URLs introduced through prompt injection.
What does an attacker need to exploit it?
The attacker needs a way to cause extract_document_content to fetch a URL they supply. No authentication, user interaction, or special network conditions are indicated by the provided severity vector.
Are default URL restrictions sufficient to prevent exploitation?
No URL restrictions are described: the tool fetches caller-supplied URLs without scheme, host, or IP filtering. This allows requests to internal resources as well as externally reachable URLs.
What can be done while a fix is unavailable?
Restrict or disable access to extract_document_content where untrusted prompts or URL input can reach it. Apply scheme, hostname, and IP-address filtering before URL fetching, particularly to block internal-resource destinations.
How can teams determine whether they may be affected?
Review whether their OWL deployment uses extract_document_content and whether it accepts URLs derived from callers, documents, or model prompts. Also verify whether fetched response content is returned to the agent context, as described.