Is CVE-2026-44520 actively exploited?

No active exploitation of CVE-2026-44520 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44520 be exploited remotely?

Yes. CVE-2026-44520 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-44520?

CVE-2026-44520 has a CVSS score of 5.7 (MEDIUM).

HOME VULNERABILITIESCVE-2026-44520

MEDIUM

CVE-2026-44520

CWE-601Published: May 14, 2026· Updated: May 14, 2026

5.7

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.2th

Official Description

Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit semantic relationships. Prior to 1.5.1, the URLInputHandler class in docling_graph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address. The URLValidator only checks for a valid scheme and non-empty netloc, performing no IP-level validation. Additionally, requests.head() was called with allow_redirects=True, allowing an attacker to redirect requests to internal endpoints via an intermediary URL. An attacker who can control the --source CLI argument or PipelineConfig.source API parameter can trigger Server-Side Request Forgery (SSRF). This vulnerability is fixed in 1.5.1.

NVD Source

Technical Analysis

CVE-2026-44520 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.7.