# CVE-2026-76898: draw.io IPv6 ULA address bypass in URL validation

Source: https://junglewise.ai/threats/cve-2026-76898-draw-io-is-a-configurable-diagramming-and-whiteboarding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76898 · Severity: info · Published 2026-09-21

draw.io is a web-based diagramming and whiteboarding application. An unauthenticated attacker can bypass the IPv6 address validation in the /embed2.js endpoint to fetch internal resources and disclose sensitive cloud metadata or data from other services on the internal network, such as AWS instance metadata credentials.

Technologies: [JGraph Draw.Io](https://junglewise.ai/threats/technologies/jgraph-draw-io). Vendors: [JGraph](https://junglewise.ai/threats/vendors/jgraph).

## Quick answers

**Is CVE-2026-76898 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76898 being exploited in the wild.

**How severe is CVE-2026-76898?** Informational severity, published 21 September 2026.

**Which products and versions are affected?** JGraph Draw.Io prior to 30.3.8.

**Is there a fix for CVE-2026-76898?** A patch was published on 2026-07-14: Version 30.3.8 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76898 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-76898?** Check whether you run JGraph Draw.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Utils.sanitizeUrl() which attempts to block IPv6 Unique Local Addresses (fc00::/7 and fd00::/7) using string prefix comparison, but the JDK returns expanded address forms, allowing the full ranges to be reached. The flaw affects the unauthenticated /embed2.js?fetch= endpoint in EmbedServlet2, which can retrieve and reflect internal IPv6 resources without requiring DNS rebinding or proxy feature flags. A similar issue exists in the separate ProxyServlet path's validatedAddress() method, though that requires ENABLE_DRAWIO_PROXY=1.

## Affected products

- jgraph draw.io prior to 30.3.8

## Timeline

- 2026-09-21: disclosed: CVE-2026-76898 published
- 2026-07-14: patched: Version 30.3.8 released with fix

## References

- [https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d](https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d)
- [https://github.com/jgraph/drawio/releases/tag/v30.3.8](https://github.com/jgraph/drawio/releases/tag/v30.3.8)

## Related threats

- [draw.io incomplete SSRF blocklist in proxy endpoint](https://junglewise.ai/threats/cve-2026-97373-draw-io-is-a-configurable-diagramming-and-whiteboarding)
- [draw.io prototype pollution in GraphML decoder](https://junglewise.ai/threats/cve-2026-115762-draw-io-is-a-configurable-diagramming-and-whiteboarding)
- [draw.io OAuth state validation bypass in self-hosted deployments](https://junglewise.ai/threats/cve-2026-63373-draw-io-is-a-configurable-diagramming-and-whiteboarding)
- [draw.io server-side request forgery via proxy configuration](https://junglewise.ai/threats/cve-2026-63334-draw-io-is-a-configurable-diagramming-and-whiteboarding)
- [draw.io stored XSS via crafted .drawio file in TextFormatPanel](https://junglewise.ai/threats/cve-2026-58504-draw-io-is-a-configurable-diagramming-and-whiteboarding)