CVE-2026-76898
Received Received - Intake

IPv6 ULA Bypass in draw.io EmbedServlet

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated request to /embed2.js?fetch= can therefore make src/main/java/com/mxgraph/online/EmbedServlet2.java fetch an IPv6 ULA internal resource and reflect the response to the requester. Utils.validatedAddress() uses the same private-address check for the separate ProxyServlet path, which requires ENABLE_DRAWIO_PROXY=1. The primary /embed2.js path requires no proxy feature flag or DNS rebinding, and it can disclose cloud metadata credentials or data from other IPv6-reachable internal services. This issue is fixed in version 30.3.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-76898
EUVD
EUVD-2026-84009

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
jgraph drawio 30.3.8
jgraph drawio to 30.2.7 (exc)
draw.io draw.io 30.3.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76898 is a Server-Side Request Forgery (SSRF) vulnerability in draw.io versions before 30.3.8. The issue occurs because the application incorrectly validates IPv6 Unique Local Addresses by comparing text prefixes like fc00:: and fd00::, but the JDK returns expanded IPv6 addresses. This allows attackers to bypass security checks and send requests to internal IPv6 services, including AWS metadata endpoints, via the /embed2.js?fetch= endpoint without authentication.

Detection Guidance

Check if your draw.io instance is running a vulnerable version (<30.3.8). Inspect network logs for requests to /embed2.js?fetch= targeting internal IPv6 ULA addresses. Use commands like curl to test for SSRF by attempting to fetch internal resources via the vulnerable endpoint.

Impact Analysis

This vulnerability allows unauthenticated attackers to access internal IPv6 services, potentially exposing sensitive data like cloud metadata credentials or internal service responses. Attackers could exploit this to exfiltrate data or gain unauthorized access to internal resources.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal systems, potentially exposing sensitive data such as cloud metadata credentials or internal service responses. For GDPR, this may violate principles of data protection and security (Article 32). For HIPAA, it could risk unauthorized access to protected health information if internal services are compromised.

Mitigation Strategies

Upgrade draw.io to version 30.3.8 or later immediately. Disable the /embed2.js?fetch= endpoint if not required. Review and restrict access to internal IPv6 ULA addresses. Monitor network traffic for unusual requests to internal services.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76898. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart