CVE-2026-76898 Details
Description
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated request to /embed2.js?fetch= can therefore make src/main/java/com/mxgraph/online/EmbedServlet2.java fetch an IPv6 ULA internal resource and reflect the response to the requester. Utils.validatedAddress() uses the same private-address check for the separate ProxyServlet path, which requires ENABLE_DRAWIO_PROXY=1. The primary /embed2.js path requires no proxy feature flag or DNS rebinding, and it can disclose cloud metadata credentials or data from other IPv6-reachable internal services. This issue is fixed in version 30.3.8.
A server-side request forgery (SSRF) vulnerability has been identified in draw.io versions prior to 30.3.8. The issue arises in the URL sanitization process, where the application fails to properly block IPv6 Unique Local Addresses (ULAs) due to a mismatch in address format. This oversight allows unauthenticated requests to the '/embed2.js?fetch=' endpoint to access internal resources on hosts with ULA addresses, including AWS metadata credentials. The vulnerability can also be exploited through the '/proxy' endpoint if a specific feature flag is enabled.
Users can upgrade to draw.io version 30.3.8 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jgraph/drawio/security/advisories/GHSA-m3q9-cwfq-hcjc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d | [email protected] | Source CodeVendor |
| https://github.com/jgraph/drawio/releases/tag/v30.3.8 | [email protected] | Release NotesVendor |
| https://github.com/jgraph/drawio/security/advisories/GHSA-m3q9-cwfq-hcjc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| draw.io | < 30.2.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |