CVE-2026-108749
Description
A flaw was found in docling-serve. An unauthenticated remote attacker can access sensitive process memory metrics and trigger internal garbage collection routines by querying memory monitoring endpoints that fail to enforce authentication controls. Successful exploitation allows an attacker to bypass configured Application Programming Interface (API) key restrictions and obtain internal system telemetry.
Statement
A low impact information disclosure flaw was found in docling-serve, which Red Hat ships as the docling-serve-cuda-rhel9 container in Red Hat OpenShift AI. The /v1/memory/stats and /v1/memory/counts management endpoints omit the API-key authentication dependency that protects the rest of the docling-serve API. In deployments that set a non-empty DOCLING_SERVE_API_KEY and also enable DOCLING_SERVE_ENABLE_MANAGEMENT_ENDPOINTS=true, an unauthenticated remote attacker who can reach the service can query these endpoints without the X-Api-Key header and read process and cgroup memory telemetry, garbage-collector counters, tracked-object counts, object type histograms, and asyncio task counts, and can force repeated full garbage collections and heap enumerations that add server-side workload. The exposed data is operational telemetry only: document contents, task results, the API key itself, and other secrets are not returned, and the conversion, task, and clear routes remain protected. Deployments using default settings are not affected because management endpoints are disabled by default, and deployments that do not configure an API key are unauthenticated by configuration. Red Hat rates this flaw Low severity (CVSS 3.1 score 3.7), lower than the upstream CVSS 4.0 score of 6.3 (Moderate), because the disclosure is limited to non-sensitive diagnostic telemetry. The fix is deferred for Red Hat OpenShift AI because trackers are not filed for Low severity flaws; the residual risk is limited to unauthenticated disclosure of memory telemetry and the ability of a remote caller to repeatedly trigger garbage-collection work on the service.
Mitigation
The memory endpoints are opt-in and only exposed when DOCLING_SERVE_ENABLE_MANAGEMENT_ENDPOINTS=true. Deployments that do not need the memory diagnostics can set DOCLING_SERVE_ENABLE_MANAGEMENT_ENDPOINTS=false (the default), which makes both /v1/memory endpoints return 403 and removes the exposure. If management endpoints are required, restrict network access to the /v1/memory paths, for example with a reverse proxy, ingress rule, or network policy in front of the service, so that unauthenticated callers cannot reach them; a network-layer restriction on these paths removes the exposure independently of the application. The upstream fix is to add the same API-key authentication dependency that the other management routes carry to both memory handlers; no fixed upstream release has been announced. Red Hat has deferred the fix for this Low severity flaw.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 3.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
