CVE-2026-63334
Received Received - Intake

Server-Side Request Forgery in draw.io Prior to 30.2.7

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in Utils.sanitizeUrl() using one DNS resolution, while src/main/java/com/mxgraph/online/ProxyServlet.java later calls URL.openConnection() and performs a second resolution. An attacker-controlled hostname can resolve to a public address during validation and then to a private, link-local, or cloud metadata address when the connection is opened. Successful exploitation can return cloud instance metadata or responses from internal HTTP services through the proxy. This issue is fixed in version 30.2.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-63334
EUVD
EUVD-2026-84007

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jgraph drawio 30.2.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63334 is a Server-Side Request Forgery (SSRF) vulnerability in draw.io versions prior to 30.2.7. It occurs when the ENABLE_DRAWIO_PROXY=1 setting is enabled. The issue involves two separate DNS resolutions during URL validation and connection opening, allowing DNS rebinding attacks. An attacker can exploit this by controlling a domain that resolves to a public IP during validation but changes to a private or cloud metadata IP during connection, bypassing security checks.

Detection Guidance

To detect this vulnerability, check if your draw.io deployment has ENABLE_DRAWIO_PROXY=1 enabled. Inspect network logs for unusual outbound requests to private or cloud metadata addresses (e.g., 169.254.169.254). Use commands like curl or nslookup to test DNS resolution behavior for proxy endpoints.

Impact Analysis

This vulnerability allows attackers to access internal network resources, including cloud metadata endpoints like AWS IMDSv1 or GCP service account tokens. It could lead to exfiltration of sensitive data such as temporary IAM credentials or probing internal HTTP services. Exploitation does not require privileges or user interaction and can occur over a network.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing internal network resources or cloud metadata through SSRF. Unauthorized access to internal services or cloud instance metadata may lead to data breaches or unauthorized data exposure, violating confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade to draw.io version 30.2.7 or later. Disable the proxy feature by setting ENABLE_DRAWIO_PROXY=0 if not required. Ensure cloud instances use IMDSv2 for metadata access to mitigate SSRF risks. Monitor network traffic for suspicious outbound connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63334. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart