CVE-2026-44520 Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler
Attackers can trigger Server-Side Request Forgery by supplying malicious URLs, allowing access to internal network resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44520?
CVE-2026-44520 is a medium-severity server-side request forgery vulnerability in docling-project docling-graph, published on 14 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit semantic relationships. Prior to 1.5.1, the URLInputHandler class in docling_graph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address. The URLValidator only checks for a valid scheme and non-empty netloc, performing no IP-level validation. Additionally, requests.head() was called with allow_redirects=True, allowing an attacker to redirect requests to internal endpoints via an intermediary URL. An attacker who can control the --source CLI argument or PipelineConfig.source API parameter can trigger Server-Side Request Forgery (SSRF). This vulnerability is fixed in 1.5.1.
Which versions are affected by CVE-2026-44520?
3 open source packages ship an affected version, including docling-graph.
| Package | Affected | Fixed in |
|---|---|---|
docling-graph PyPI | All versions | 1.5.1 |
docling-graph PyPI | All versions | 1.5.1 |
docling-graph PyPI | All versions | 1.5.1 |
How do I fix CVE-2026-44520?
Upgrade docling-graph to 1.5.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-44520 being exploited?
There is no known exploitation of CVE-2026-44520 in the wild and no public exploit code.
Sources
Also known as GHSA-fqph-j6v6-jvgx, PYSEC-2026-2458.