CVE-2026-72777: Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url
Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to internal addresses, allowing them to reach arbitrary internal HTTP services and exfiltrate responses including cloud metadata.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72777?
CVE-2026-72777 has a severity rating of high, with a score of 8.6.
How do I fix CVE-2026-72777?
To fix CVE-2026-72777, upgrade to a version of Next AI Draw.io that is patched for the SSRF vulnerability.
What kind of vulnerability is CVE-2026-72777?
CVE-2026-72777 is a server-side request forgery (SSRF) vulnerability.
What are the potential impacts of CVE-2026-72777?
The potential impacts of CVE-2026-72777 include unauthorized access to internal services and data leakage.
Who is affected by CVE-2026-72777?
CVE-2026-72777 affects all versions of Next AI Draw.io prior to 0.4.16.