Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-63334

draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist

CVSS 3.1 6.8 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-63334

Published

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in Utils.sanitizeUrl() using one DNS resolution, while src/main/java/com/mxgraph/online/ProxyServlet.java later calls URL.openConnection() and performs a second resolution. An attacker-controlled hostname can resolve to a public address during validation and then to a private, link-local, or cloud metadata address when the connection is opened. Successful exploitation can return cloud instance metadata or responses from internal HTTP services through the proxy. This issue is fixed in version 30.2.7.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-63334

Published

drawio

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "jgraph",
                    "product": "drawio",
                    "versions": [
                        {
                            "version": "< 30.2.7",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON