CVE-2026-129485
Received Received - Intake

Kroki BlockDiag SSRF Vulnerability Before 0.36.0

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: VulnCheck

Description
Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unauthenticated attackers to make server requests via node icon and background attributes. Attackers can send crafted diagrams to POST /blockdiag/svg or sibling endpoints to query internal services or cloud metadata and read local image files from the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-129485
EUVD
EUVD-2026-126082

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
yuzutech kroki to 0.36.0 (exc)
yuzutech blockdiag 3.4.2
yuzutech blockdiag 3.4.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-129485 is a Server-Side Request Forgery (SSRF) vulnerability in Kroki versions 0.35.0 and earlier. It affects the BlockDiag family of engines (blockdiag, seqdiag, actdiag, nwdiag, packetdiag, rackdiag). The issue allows unauthenticated attackers to send crafted diagrams to endpoints like POST /blockdiag/svg, which can trigger the server to fetch arbitrary URLs or local files. This exposes sensitive data or enables unauthorized access to internal services.

Detection Guidance

Check if your Kroki instance is running a vulnerable version (0.35.0 or earlier) by inspecting the server logs or running 'curl -X POST http://<kroki-server>/blockdiag/svg -d "diagram_source"' to test for SSRF behavior. Look for requests to internal services or cloud metadata endpoints like 169.254.169.254.

Impact Analysis

This vulnerability can allow attackers to read local files on the server if they are accessible by the Kroki process. It also enables requests to internal services or cloud metadata endpoints, potentially exposing sensitive information. Attackers could use this to probe internal networks or retrieve data from services like AWS metadata endpoints.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations using vulnerable versions of Kroki may face compliance violations if data is exposed through SSRF attacks.

Mitigation Strategies

Upgrade Kroki to version 0.36.0 or later. If upgrading is not immediately possible, block access to the BlockDiag endpoints (/blockdiag/svg and siblings) via network restrictions or firewall rules. Set KROKI_SAFE_MODE=secure to enforce the --no-external-images flag.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129485. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...