CVE-2026-44520 — Server-Side Request Forgery

title: CVE-2026-44520 - Docling-Graph SSRF via URLInputHandler
id: scw-2026-05-14-ai-1
status: experimental
level: high
description: |
  This rule detects potential exploitation of CVE-2026-44520. It specifically looks for HTTP POST requests targeting the URLInputHandler script with a 'source' parameter, which is indicative of an attacker attempting to trigger Server-Side Request Forgery (SSRF) by supplying a malicious URL. The vulnerability lies in the lack of IP validation and the use of allow_redirects=True in requests.head(), allowing redirection to internal endpoints.
author: SCW Feed Engine (AI-generated)
date: 2026-05-14
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-44520/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/docling_graph/core/input/handlers.py'
      cs-uri-query|contains:
          - 'source='
      cs-method|exact:
          - 'POST'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse