CVE-2026-85675

CVE-2026-85675 is a server-side request forgery (CWE-918) in the extract_document_content tool of OWL's DocumentProcessingToolkit, which fetches caller-supplied URLs with no validation of scheme, host, or IP address. An attacker can trigger the flaw through prompt injection — embedding a malicious URL in content the agent is asked to process — causing the server to issue requests to attacker-chosen targets without requiring privileges or user interaction. Because responses are returned into the agent context, the attacker can steer the server toward internal resources such as localhost services, internal APIs, or cloud metadata endpoints and read the results, producing high confidentiality impact (CVSS 4.0: 8.7 High). Anyone running OWL with the document processing toolkit enabled is affected, particularly deployments that can reach sensitive internal or metadata services. There is no known public proof of concept, it is not in the CISA KEV catalog, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

What to do: No patched version is documented yet, so mitigate by restricting what extract_document_content can fetch — block loopback, private/link-local ranges, and cloud metadata endpoints — or disable or sandbox the tool when processing untrusted content. Apply egress controls on hosts running OWL so SSRF-initiated requests cannot reach sensitive internal services, and treat documents from untrusted sources as prompt-injection vectors. Monitor the OWL project and the VulnCheck advisory (CNA: [email protected]) for a fixed release and upgrade promptly when one is published.