CVE-2026-105742: Docling: Configured HTTP headers sent to every remote image host named by a document
HTMLBackendOptions.headers is documented for passing authentication headers (API keys, bearer tokens) when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled image URL receives the caller’s credentials.
References
- github.com/advisories/GHSA-p3fw-7699-7926
- github.com/docling-project/docling/commit/5e469137f275ffc443306a30d12a3a45bceb80fb
- github.com/docling-project/docling/pull/4420
- github.com/docling-project/docling/releases/tag/v2.132.0
- github.com/docling-project/docling/security/advisories/GHSA-p3fw-7699-7926
- nvd.nist.gov/vuln/detail/CVE-2026-105742
Code Behaviors & Features
Detect and mitigate CVE-2026-105742 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →