CVE-2026-63334

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in Utils.sanitizeUrl() using one DNS resolution, while src/main/java/com/mxgraph/online/ProxyServlet.java later calls URL.openConnection() and performs a second resolution. An attacker-controlled hostname can resolve to a public address during validation and then to a private, link-local, or cloud metadata address when the connection is opened. Successful exploitation can return cloud instance metadata or responses from internal HTTP services through the proxy. This issue is fixed in version 30.2.7.

• CWE-367
• CWE-918

• https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e
• https://github.com/jgraph/drawio/releases/tag/v30.2.7
• https://github.com/jgraph/drawio/security/advisories/GHSA-3v4h-8r2c-m8c5

Published

Sep 21, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6332CWE-312: Cleartext Storage of Sensitive Information vulnerab…7.5
• CVE-2026-63325Redocly CLI makes OpenAPI validation, linting, and documenta…7.8
• CVE-2026-63328Trivy is a security scanner. Prior to 0.72.0, plugin manifes…6.8
• CVE-2026-63329Warpgate is an open source SSH, HTTPS and MySQL bastion host…4.9
• CVE-2026-6333Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fa…5
• CVE-2026-63330Warpgate is an open source SSH, HTTPS and MySQL bastion host…7.7
• CVE-2026-63335The RabbitMQ Java client library allows Java and JVM-based a…6.3
• CVE-2026-63336The RabbitMQ Java client library allows Java and JVM-based a…5.1
• CVE-2026-63337The RabbitMQ Java client library allows Java and JVM-based a…7.5
• CVE-2026-6334Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fa…3.8
• CVE-2026-63342Hatchet is a platform for orchestrating background tasks, AI…6.3
• CVE-2026-63343Incus is a system container and virtual machine manager. Pri…9.9