CVE-2026-76898: draw.io IPv6 ULA Information Disclosure

CVE-2026-76898 Overview

CVE-2026-76898 is a Server-Side Request Forgery (SSRF) vulnerability in draw.io, a configurable diagramming and whiteboarding application. The flaw exists in src/main/java/com/mxgraph/online/Utils.java, where Utils.sanitizeUrl() validates IPv6 Unique Local Addresses (ULA) using string prefix comparisons against fc00:: and fd00::. Because the JDK returns expanded IPv6 address forms, the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated attacker can send a crafted request to /embed2.js?fetch= and force EmbedServlet2.java to fetch internal IPv6 resources. The vulnerability is fixed in version 30.3.8 [CWE-918].

Critical Impact
Unauthenticated attackers can retrieve cloud metadata credentials and internal service responses without any proxy feature flag or DNS rebinding.

Affected Products

draw.io (jgraph/drawio) versions prior to 30.3.8
Deployments exposing the /embed2.js endpoint
Instances running on IPv6-reachable cloud environments (including AWS with metadata at fd00:ec2::/32)

Discovery Timeline

2026-07-13 - draw.io version 30.3.8 released with SSRF patch
2026-09-21 - CVE CVE-2026-76898 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-76898

Vulnerability Analysis

The vulnerability resides in the URL sanitization logic of Utils.sanitizeUrl(). The method attempts to block IPv6 ULA ranges by checking whether the resolved address string begins with fc00:: or fd00::. This check fails because the JDK's IPv6 handling returns fully expanded address representations rather than the compressed form. As a result, addresses like fc00:0000:0000:... or fd00:ec2:0000:... bypass the prefix comparison and pass validation.

Once the check is bypassed, EmbedServlet2.java processes the request through /embed2.js?fetch= and issues an outbound HTTP request to the internal address. The servlet reflects the response body back to the unauthenticated requester. This exposes cloud instance metadata services and any other IPv6-reachable internal HTTP endpoint. On AWS, the IPv6 metadata endpoint at fd00:ec2::/32 can return IAM credentials tied to the host role.

Root Cause

The root cause is improper input validation of IPv6 addresses. String prefix comparison is unsuitable for validating IP address ranges because expanded and compressed IPv6 notations produce different string forms. The correct approach is bitwise comparison against the fc00::/7 prefix after parsing the address into its numeric form.

Attack Vector

The attack requires only an unauthenticated HTTP request to the /embed2.js?fetch= endpoint with a target URL containing an IPv6 ULA in expanded form. Unlike the separate ProxyServlet path guarded by Utils.validatedAddress(), the /embed2.js path requires no feature flag such as ENABLE_DRAWIO_PROXY=1 and no DNS rebinding technique. The response from the internal target is reflected directly to the attacker.

text

# Patch reference from ChangeLog - draw.io 30.3.8 release
+13-JUL-2026: 30.3.8
+
+- Patches java SSRF - GHSA-m3q9-cwfq-hcjc
+- Completes SSRF blocklist in proxy - GHSA-xc39-mcq4-fr4q

# Source: https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d

Detection Methods for CVE-2026-76898

Indicators of Compromise

Inbound HTTP requests to /embed2.js?fetch= containing IPv6 addresses in expanded form (for example, fc00:0000:0000:... or fd00:ec2:0000:...)
Outbound connections from draw.io hosts to internal IPv6 ULA ranges or cloud metadata IPv6 endpoints
Unexpected AWS IAM credential usage from IP addresses outside the host instance
HTTP responses from /embed2.js containing metadata-service JSON payloads such as AccessKeyId or SecurityCredentials

Detection Strategies

Inspect web server access logs for requests to /embed2.js with fetch= parameters targeting IPv6 addresses, particularly in expanded notation
Monitor egress traffic from draw.io application hosts for connections to fc00::/7 destinations
Alert on any HTTP traffic from application servers to fd00:ec2::/32 where the process is not an authorized metadata client

Monitoring Recommendations

Enable IPv6 flow logging on cloud VPCs hosting draw.io deployments
Correlate outbound requests initiated by the Java draw.io process against a baseline of legitimate destinations
Track new IAM API calls originating from IP addresses outside the expected instance range

How to Mitigate CVE-2026-76898

Immediate Actions Required

Upgrade draw.io to version 30.3.8 or later, which patches the Java SSRF issue tracked as GHSA-m3q9-cwfq-hcjc
Rotate any IAM credentials or secrets that may have been exposed to the draw.io host through the metadata service
Audit web server logs for prior exploitation attempts against /embed2.js?fetch=

Patch Information

The fix is included in draw.io version 30.3.8, released on 13 July 2026. The changelog entry reads "Patches java SSRF - GHSA-m3q9-cwfq-hcjc" and a companion fix "Completes SSRF blocklist in proxy - GHSA-xc39-mcq4-fr4q". Details are available in the GitHub Security Advisory GHSA-m3q9-cwfq-hcjc and the GitHub Release v30.3.8 notes.

Workarounds

Restrict network access to /embed2.js at the reverse proxy or web application firewall layer until patched
Block outbound IPv6 connections from draw.io hosts to fc00::/7 at the network firewall or security group level
Enforce IMDSv2 with a hop limit of 1 on AWS instances to reduce metadata exposure surface
Disable IPv6 on the draw.io host where the application does not require it

bash

# Example egress restriction for IPv6 ULA ranges (Linux ip6tables)
ip6tables -A OUTPUT -d fc00::/7 -j REJECT
ip6tables -A OUTPUT -d fd00:ec2::/32 -j REJECT