Is CVE-2026-63334 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63334 being exploited in the wild.

How severe is CVE-2026-63334?

Medium severity, with a CVSS score of 6.8, published 21 September 2026.

Is there a fix for CVE-2026-63334?

A patch was published on 2026-06-30. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63334 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-63334?

Check whether you run JGraph Draw.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63334: draw.io server-side request forgery via proxy configuration

CVE-2026-63334 · Severity: medium · CVSS 6.8 · Published 2026-09-21

draw.io is a diagramming and whiteboarding application used for creating flowcharts and diagrams. When deployed with the proxy feature enabled (ENABLE_DRAWIO_PROXY=1), an attacker can exploit a time-of-check-time-of-use flaw in DNS resolution to bypass security checks and access internal cloud metadata services or corporate HTTP services, potentially exposing sensitive credentials and system information. The vulnerability affects all versions prior to 30.2.7.

Technologies: JGraph Draw.Io. Vendors: JGraph.

Quick answers

Is CVE-2026-63334 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63334 being exploited in the wild.
How severe is CVE-2026-63334?: Medium severity, with a CVSS score of 6.8, published 21 September 2026.
Which products and versions are affected?: JGraph Draw.Io before 30.2.7.
Is there a fix for CVE-2026-63334?: A patch was published on 2026-06-30. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63334 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-63334?: Check whether you run JGraph Draw.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A server-side request forgery (SSRF) vulnerability exists in the proxy servlet due to two separate DNS resolutions performed during URL validation and connection opening. The sanitizeUrl() method in Utils.java validates that a hostname does not resolve to private addresses, but ProxyServlet.java performs a second DNS resolution when actually opening the connection. An attacker can use DNS timing techniques to resolve an attacker-controlled hostname to a public address during validation, then to a private, link-local, or cloud metadata address during connection, bypassing the security check. This requires the ENABLE_DRAWIO_PROXY configuration flag to be enabled.

Affected products

jgraph draw.io before 30.2.7

Timeline

2026-09-21: disclosed
2026-06-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.