Executive brief
draw.io is a web-based diagramming and whiteboarding application. An unauthenticated attacker can bypass the IPv6 address validation in the /embed2.js endpoint to fetch internal resources and disclose sensitive cloud metadata or data from other services on the internal network, such as AWS instance metadata credentials.
Technical details
The vulnerability exists in Utils.sanitizeUrl() which attempts to block IPv6 Unique Local Addresses (fc00::/7 and fd00::/7) using string prefix comparison, but the JDK returns expanded address forms, allowing the full ranges to be reached. The flaw affects the unauthenticated /embed2.js?fetch= endpoint in EmbedServlet2, which can retrieve and reflect internal IPv6 resources without requiring DNS rebinding or proxy feature flags. A similar issue exists in the separate ProxyServlet path's validatedAddress() method, though that requires ENABLE_DRAWIO_PROXY=1.
Affected products
- jgraph draw.io prior to 30.3.8
Timeline
- 2026-09-21: disclosed: CVE-2026-76898 published
- 2026-07-14: patched: Version 30.3.8 released with fix