CVE-2026-108749

The docling-serve software (versions 1.14.0 through 1.36.0) contains a missing authentication vulnerability. The /v1/memory/stats and /v1/memory/counts endpoints omit the require_auth dependency, allowing unauthenticated attackers to bypass the configured DOCLING_SERVE_API_KEY . Exploitation can ...