CVE-2026-85675: OWL DocumentProcessingToolkit SSRF Vulnerability

CVE-2026-85675 Overview

CVE-2026-85675 is a server-side request forgery (SSRF) vulnerability in OWL's DocumentProcessingToolkit. The extract_document_content tool fetches caller-supplied URLs without validating the scheme, host, or IP address. Attackers can supply URLs through prompt injection to force the server to fetch internal resources. Responses are returned into the agent context, allowing exfiltration of internal data. The flaw is tracked under CWE-918: Server-Side Request Forgery and affects the Camel AI OWL agent framework. Additional technical context is available in the VulnCheck Advisory: SSRF in Owl.

Critical Impact
Unauthenticated attackers can pivot through the OWL agent to reach internal services, cloud metadata endpoints, and other network-restricted resources.

Affected Products

Camel AI OWL agent framework
OWL DocumentProcessingToolkit module (owl/utils/document_toolkit.py)
The extract_document_content tool exposed to LLM agents

Discovery Timeline

2026-09-04 - CVE-2026-85675 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-85675

Vulnerability Analysis

The extract_document_content tool in OWL's DocumentProcessingToolkit accepts a URL parameter from the agent and issues an outbound HTTP request to retrieve document content. The implementation performs no allowlist or denylist checks on the URL scheme, hostname, or resolved IP address. As a result, private IP ranges such as 10.0.0.0/8, 127.0.0.0/8, and 169.254.169.254 are reachable from the toolkit context. Fetched responses are passed back into the agent's context window, giving the attacker read access to whatever the server retrieves. Because the URL originates from LLM tool arguments, prompt injection is a viable delivery mechanism against agents that ingest untrusted documents, web content, or user chat input.

Root Cause

The root cause is missing input validation on network destinations. The toolkit trusts URLs produced by the LLM without applying a scheme allowlist (for example, restricting to https) or resolving the target host to confirm it is not an internal, loopback, link-local, or reserved address. This maps directly to CWE-918.

Attack Vector

Exploitation is network-based and requires no authentication. An attacker plants a prompt-injection payload in any content the OWL agent ingests, instructing it to call extract_document_content against an internal target such as http://169.254.169.254/latest/meta-data/ on AWS, http://metadata.google.internal/, an internal admin panel, or a Redis or Elasticsearch endpoint. The server issues the request from its own network position and returns the response body into the agent context, where it can be exfiltrated in subsequent output.

A verified proof-of-concept is not included with the advisory. Refer to the GitHub File: Document Toolkit Script and GitHub Issue #615: Discussion for implementation details and maintainer discussion.

Detection Methods for CVE-2026-85675

Indicators of Compromise

Outbound HTTP requests from the OWL host to RFC 1918 addresses, loopback, or link-local ranges such as 169.254.169.254
Agent tool-call logs showing extract_document_content invocations with internal hostnames, raw IP literals, or non-http(s) schemes such as file://, gopher://, or ftp://
Unusual document-extraction responses containing cloud metadata tokens, internal service banners, or Kubernetes service account material

Detection Strategies

Log every extract_document_content tool call with the full URL, source prompt, and response size, then alert on internal or metadata destinations
Correlate LLM prompt content with subsequent outbound network flows to identify prompt-injection chains that pivot into SSRF
Baseline expected external domains fetched by the agent and flag deviations

Monitoring Recommendations

Enable egress flow logging on the host or container running OWL and forward to a central analytics platform
Monitor cloud metadata endpoints for access from workload identities that should never query them
Review agent transcripts for injected instructions containing URLs, especially those referencing internal DNS names or IP literals

How to Mitigate CVE-2026-85675

Immediate Actions Required

Disable or unregister the extract_document_content tool from agent toolchains until a validated fix is in place
Block outbound access from the OWL host to RFC 1918, loopback, link-local, and cloud metadata addresses at the network layer
Require IMDSv2 with hop-limit 1 on AWS workloads, and equivalent metadata protections on Azure and GCP, to blunt metadata-service abuse

Patch Information

No fixed version is listed in the NVD entry at publication. Track the upstream project via the GitHub Repository: Camel AI Owl and GitHub Issue #615: Discussion for remediation status, and monitor the VulnCheck Advisory: SSRF in Owl for updates.

Workarounds

Wrap URL fetching with a validator that enforces an https-only scheme allowlist and resolves the hostname to confirm it is a public, routable address
Route all agent-initiated HTTP requests through an egress proxy that enforces destination allowlists and strips redirects to internal targets
Sanitize and constrain agent inputs to reduce prompt-injection surface, and treat any URL produced by the LLM as untrusted input requiring server-side validation

bash

# Example egress restriction using iptables to block SSRF to internal ranges
iptables -A OUTPUT -m owner --uid-owner owl -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner owl -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner owl -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner owl -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner owl -d 169.254.0.0/16 -j REJECT