Is CVE-2026-76898 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76898 being exploited in the wild.

How severe is CVE-2026-76898?

Informational severity, published 21 September 2026.

Which products and versions are affected?

JGraph Draw.Io prior to 30.3.8.

Is there a fix for CVE-2026-76898?

A patch was published on 2026-07-14: Version 30.3.8 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76898 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-76898?

Check whether you run JGraph Draw.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76898: draw.io IPv6 ULA address bypass in URL validation

CVE-2026-76898 · Severity: info · Published 2026-09-21

draw.io is a web-based diagramming and whiteboarding application. An unauthenticated attacker can bypass the IPv6 address validation in the /embed2.js endpoint to fetch internal resources and disclose sensitive cloud metadata or data from other services on the internal network, such as AWS instance metadata credentials.

Technologies: JGraph Draw.Io. Vendors: JGraph.

Quick answers

Is CVE-2026-76898 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76898 being exploited in the wild.
How severe is CVE-2026-76898?: Informational severity, published 21 September 2026.
Which products and versions are affected?: JGraph Draw.Io prior to 30.3.8.
Is there a fix for CVE-2026-76898?: A patch was published on 2026-07-14: Version 30.3.8 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76898 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-76898?: Check whether you run JGraph Draw.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Utils.sanitizeUrl() which attempts to block IPv6 Unique Local Addresses (fc00::/7 and fd00::/7) using string prefix comparison, but the JDK returns expanded address forms, allowing the full ranges to be reached. The flaw affects the unauthenticated /embed2.js?fetch= endpoint in EmbedServlet2, which can retrieve and reflect internal IPv6 resources without requiring DNS rebinding or proxy feature flags. A similar issue exists in the separate ProxyServlet path's validatedAddress() method, though that requires ENABLE_DRAWIO_PROXY=1.

Affected products

jgraph draw.io prior to 30.3.8

Timeline

2026-09-21: disclosed: CVE-2026-76898 published
2026-07-14: patched: Version 30.3.8 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.