unstructured CVE-2026-71428

Exploitation requires that the deployment pass attacker-influenced input into the url= argument of partition(), partition_html(), or partition_md() on an affected version (0.4.7 to <0.24.0) - typical of server-side or SaaS ingestion/RAG services that accept 'ingest from URL' requests. No authentication or user interaction is needed at the library level (PR:N/UI:N), and default configurations perform no host validation. Limiting factors: it is only exploitable where untrusted URLs reach these functions (purely local file ingestion is not exposed), the returned data is limited to GET-fetchable content, and the server must have network reachability to the internal/metadata target for disclosure to be useful.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, 9.3) indicates network-reachable, low-complexity, unauthenticated exploitation with a scope change and high confidentiality impact - consistent with SSRF that reaches internal systems distinct from the vulnerable host. The I:L reflects side-effecting GET requests to internal endpoints, and A:N is appropriate since there is no direct availability impact. Real-world risk is gated by exposure: the danger is high specifically for deployments that accept untrusted URLs into partition functions (e.g., SaaS document-ingestion or RAG services), and lower for local/batch use of trusted files. No EPSS score, KEV entry, or public POC is provided, so the 9.3 should be read as high potential severity rather than confirmed mass exploitation - organizations running URL-accepting ingestion services should nonetheless treat it as urgent given cloud-metadata credential theft is a well-trodden SSRF outcome. Absent EPSS and KEV data, prioritization should be driven by whether your deployment actually exposes the url= parameter to untrusted input.

An attacker submits a document-ingestion job to a hosted service built on unstructured, supplying url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ (or an internal admin endpoint). The server fetches it without validation and returns the response body as Element text, disclosing cloud IAM credentials or internal service data; DNS rebinding or redirects bypass naive host checks. No public POC is identified, but the AV:N/AC:L/PR:N profile makes exploitation straightforward wherever the url parameter is externally reachable.