{"schema_version":"1","view":"events","data":[{"id":1947,"advisory_id":"0aa36a7c-0800-4b25-b434-04100066f4c3","group_id":"advisory:0aa36a7c-0800-4b25-b434-04100066f4c3","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76898","source_published_at":"2026-09-21T16:31:54.813+00:00","published_at":"2026-10-24T21:10:42.101342+00:00","extraction_method":"structured","technologies":["core-cve","drawio"],"cve_ids":["CVE-2026-76898"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js","summary":"draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated request to /embed2.js?fetch= can therefore make src/main/java/com/mxgraph/online/EmbedServlet2.java fetch an IPv6 ULA internal resource and reflect the response to the requester. Utils.validatedAddress() uses the same private-address check for the separate ProxyServlet path, which requires ENABLE_DRAWIO_PROXY=1. The primary /embed2.js path requires no proxy feature flag or DNS rebinding, and it can disclose cloud metadata credentials or data from other IPv6-reachable internal services. This issue is fixed in version 30.3.8.","evidence":"cve:CVE-2026-76898","products":[{"name":{"value":"drawio","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-76898","aliases":["CVE-2026-76898"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"LOW"}}],"affected":[{"vendor":"jgraph","product":"drawio","versions":[{"status":"affected","version":"< 30.3.8"}]}],"modified":"2026-09-24T22:21:52.041Z","provider":"cve","references":["https://github.com/jgraph/drawio/security/advisories/GHSA-m3q9-cwfq-hcjc","https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d","https://github.com/jgraph/drawio/releases/tag/v30.3.8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-76898","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:21:23.483091Z"}}}],"references":[{"url":"https://github.com/jgraph/drawio/security/advisories/GHSA-m3q9-cwfq-hcjc","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:21:52.041Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T16:31:54.813Z"}}},"related_cves":[{"value":"CVE-2026-76898","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false,"detail_url":"/events/1947"}],"next_after":1947,"next_before":1947}