5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44520

CVE-2026-44520: Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler

Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit semantic relationships. Prior to 1.5.1, the URLInputHandler class in docling_graph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address. The URLValidator only checks for a valid scheme and non-empty netloc, performing no IP-level validation. Additionally, requests.head() was called with allow_redirects=True, allowing an attacker to redirect requests to internal endpoints via an intermediary URL. An attacker who can control the --source CLI argument or PipelineConfig.source API parameter can trigger Server-Side Request Forgery (SSRF). This vulnerability is fixed in 1.5.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44520

CVE-2026-44520:

5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
docling-graph	pip	<= 1.5.0	1.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the docling-graph library. It stems from insufficient validation of user-provided URLs. The analysis of the security patch (commit 55c0a63ada21592b79c8858020414e75abb77c3a) reveals two key functions involved in the vulnerability. First, URLValidator.validate performed only superficial checks on the URL's structure, failing to resolve the domain and inspect the resulting IP address. This allowed malicious URLs pointing to internal network resources to pass the initial validation. Second, URLInputHandler.handle would then process this URL. This function made an HTTP request with allow_redirects=True, meaning if an attacker provided a URL that redirected to an internal service (like a cloud metadata endpoint), the server would blindly follow it. The combination of these two weaknesses allowed for the SSRF. The patch addresses both issues by adding strict IP address validation (blocking private, loopback, and other restricted ranges) in URLValidator.validate and by disabling automatic redirects in URLInputHandler.handle, replacing it with a manual, validated redirect-following mechanism.

Vulnerable functions

URLInputHandler.handle

docling_graph/core/input/handlers.py

This function makes an HTTP HEAD request to a user-provided URL. The vulnerability lies in the use of `requests.head` with `allow_redirects=True` and the lack of validation to ensure the URL does not resolve to an internal or restricted IP address. An attacker could provide a URL that redirects to an internal service (e.g., cloud metadata endpoint), leading to Server-Side Request Forgery (SSRF). The patch mitigates this by setting `allow_redirects=False` and implementing a manual, validated redirect handling mechanism.

URLValidator.validate

docling_graph/core/input/validators.py

This function is responsible for validating URLs before they are processed. The original implementation was insufficient as it only checked for the presence of a hostname (`netloc`) and a valid scheme, but did not perform any DNS resolution or IP address validation. This allowed URLs pointing to internal or restricted IP addresses to pass validation, which were then used by `URLInputHandler.handle`, leading to SSRF. The patch replaces this weak check with comprehensive IP address validation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.