{"id":"CVE-2026-76898","summary":"draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js","details":"draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated request to /embed2.js?fetch= can therefore make src/main/java/com/mxgraph/online/EmbedServlet2.java fetch an IPv6 ULA internal resource and reflect the response to the requester. Utils.validatedAddress() uses the same private-address check for the separate ProxyServlet path, which requires ENABLE_DRAWIO_PROXY=1. The primary /embed2.js path requires no proxy feature flag or DNS rebinding, and it can disclose cloud metadata credentials or data from other IPv6-reachable internal services. This issue is fixed in version 30.3.8.","aliases":["GHSA-m3q9-cwfq-hcjc"],"modified":"2026-09-23T08:13:02.482219Z","published":"2026-09-21T16:31:54.813Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76898.json"},"references":[{"type":"WEB","url":"https://github.com/jgraph/drawio/releases/tag/v30.3.8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76898.json"},{"type":"ADVISORY","url":"https://github.com/jgraph/drawio/security/advisories/GHSA-m3q9-cwfq-hcjc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76898"},{"type":"FIX","url":"https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jgraph/drawio","events":[{"introduced":"0"},{"fixed":"73c4a91196246bbdb60f52b15871e82006b7972d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"30.3.8"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v30.3.6","v30.2.7","v30.2.6","v30.2.5","v30.2.4","v30.0.4","v30.0.2","v30.0.1","v30.0.0","v29.7.12","v29.7.11","v29.7.9","v29.7.8","v29.6.10","v29.6.7","v29.6.6","v29.6.5","v29.6.4","v29.6.3","v29.6.1","v29.5.2","v29.5.1","v29.3.6","v29.3.5","v29.3.2","v29.3.0","v29.2.9","v29.2.7","v29.2.6","v29.2.2","v29.0.3","v29.0.2","v28.2.9","v28.2.8","v28.2.7","v28.2.5","v28.2.3","v28.2.0","v28.1.2","v28.1.1","v28.0.9","v28.0.7","v28.0.6","v28.0.5","v28.0.4","v28.0.3","v28.0.1","v27.1.6","v27.0.9","v27.0.5","v27.0.2","v26.2.15","v26.2.8","v26.2.7","v26.2.2","v26.1.1","v26.1.0","v26.0.16","v26.0.15","v26.0.13","v26.0.9","v26.0.7","v26.0.6","v26.0.4","v26.0.3","v26.0.2","v26.0.0","v25.0.2","v25.0.1","v25.0.0","v24.8.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76898.json","vanir_signatures_modified":"2026-09-23T08:13:02Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d","target":{"file":"src/main/java/com/mxgraph/online/Utils.java","function":"validatedAddress"},"deprecated":false,"digest":{"length":1794,"function_hash":"168246928896176687700394690963952432596"},"id":"CVE-2026-76898-05bb3504"},{"source":"https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d","target":{"file":"src/main/java/com/mxgraph/online/EmbedServlet2.java"},"deprecated":false,"digest":{"line_hashes":["196325269415832384282799394620574459086","163951429916879927423065970490515472590","113919253871639426799014872809821322866","105925264544723543550342638766070104327","80869527727110091106827097688943973015","318502984369116557864197278265571741709","182902339622830740980827218983173218335","139899721050825447637327154491022461643","62688104822552041593747328114964531183","194320623952635297537975950581797134414","320957940687665119383156445706418062720","230243175846188846670429712890594456685"],"threshold":0.9},"id":"CVE-2026-76898-079264dc","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"76892277951041343052526481198232074047","length":3338},"id":"CVE-2026-76898-3138a777","signature_type":"Function","signature_version":"v1","source":"https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d","target":{"file":"src/main/java/com/mxgraph/online/EmbedServlet2.java","function":"createEmbedJavaScript"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["317159762213973568379739420242861351150","163156020614683463749051496377308641141","201859201929844662248650151542280331682","319326840680541766670581635304266218024","261471031652321805131528342950500963442","324193896816250659448494810209056500884","173217358210780132729450888300889661900","299096821301481517367944081178397250390","259803583123181893001979313600129983331","243043794115762115575459963662774122200","275632844486393660391649638234694583524","296643550155431026231932203434166245031"]},"id":"CVE-2026-76898-616b1ecf","signature_type":"Line","signature_version":"v1","source":"https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d","target":{"file":"src/main/java/com/mxgraph/online/Utils.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N"}]}