# CVE-2026-89326: Apache XML Graphics Batik origin validation bypass

Source: https://junglewise.ai/threats/cve-2026-89326-origin-validation-error-vulnerability-in-apache-xml-graphics  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-89326 · Severity: info · Published 2026-11-11

Apache XML Graphics Batik is a Java library used for rendering and manipulating SVG graphics, often embedded in document processing and web applications. The library fails to properly validate the protocol when checking if external resources come from the same origin, potentially allowing an attacker to bypass security restrictions and load unauthorized resources. This could lead to information disclosure or code execution depending on the application context.

Technologies: [Apache XML Graphics Batik](https://junglewise.ai/threats/technologies/xml-graphics-batik). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-89326 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89326 being exploited in the wild.

**How severe is CVE-2026-89326?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Apache XML Graphics Batik through 1.19.

**Is there a fix for CVE-2026-89326?** Yes: fixed in 1.20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89326 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-89326?** Check whether you run Apache XML Graphics Batik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.20

## Technical details

The vulnerability exists in Batik's external resource same-origin check, which fails to compare the URL protocol component when validating if a resource can be loaded. An attacker can exploit this by using a different protocol (e.g., changing http to https or file) while keeping the same hostname to bypass the origin restriction. The fix is available in version 1.20.

## Affected products

- Apache XML Graphics Batik through 1.19

## Timeline

- 2026-11-11: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://issues.apache.org/jira/browse/BATIK-1398](https://issues.apache.org/jira/browse/BATIK-1398)

## Related threats

- [Apache XML Graphics Batik SSRF vulnerability](https://junglewise.ai/threats/cve-2026-44929-server-side-request-forgery-ssrf-vulnerability-in-apache-xml)
- [Apache XML Graphics Batik SSRF in SVG color-profile xml:base](https://junglewise.ai/threats/cve-2026-49236-server-side-request-forgery-ssrf-vulnerability-in-apache-xml)
- [Apache Batik SVG font metadata cross-site scripting](https://junglewise.ai/threats/cve-2026-40853-a-cross-site-scripting-via-unencoded-font-metadata-in-apache)
- [Apache XML Graphics Batik XXE vulnerability](https://junglewise.ai/threats/cve-2026-90993-xxe-vulnerability-in-apache-xml-graphics-batik-this-issue-affects)
- [Apache XML Graphics Batik uncontrolled recursion](https://junglewise.ai/threats/cve-2026-111792-uncontrolled-recursion-vulnerability-in-apache-xml-graphics)