CVE-2026-76898: draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated request to /embed2.js?fetch= can therefore make src/main/java/com/mxgraph/online/EmbedServlet2.java fetch an IPv6 ULA internal resource and reflect the response to the requester. Utils.validatedAddress() uses the same private-address check for the separate ProxyServlet path, which requires ENABLEDRAWIOPROXY=1. The primary /embed2.js path requires no proxy feature flag or DNS rebinding, and it can disclose cloud metadata credentials or data from other IPv6-reachable internal services. This issue is fixed in version 30.3.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
draw.ioto a version that resolves this vulnerability.Fixed in 30.3.8 - Configuration
Set ENABLE_DRAWIO_PROXY to 0/disable the ProxyServlet unless explicitly required, since the separate ProxyServlet path requires ENABLE_DRAWIO_PROXY=1 and uses the same private-address check.
draw.io ProxyServlet ENABLE_DRAWIO_PROXY = 1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running a version earlier than 30.3.8 are exposed through /embed2.js when the draw.io server can reach IPv6 ULA-addressed internal resources. This includes the AWS metadata range fd00:ec2::/32.
What does an attacker need to exploit the primary path?
An attacker can send an unauthenticated request to /embed2.js with the fetch parameter targeting a reachable IPv6 ULA resource. The primary path does not require DNS rebinding or the proxy feature flag.
Does disabling the draw.io proxy feature prevent exploitation?
No. ENABLE_DRAWIO_PROXY=1 controls the separate ProxyServlet path, but the primary /embed2.js path does not require that feature to be enabled.
How can I determine whether the issue is remediated?
The issue is fixed in draw.io version 30.3.8. Versions before 30.3.8 use the affected IPv6 ULA validation logic in Utils.sanitizeUrl().