CVE-2026-97373 in draw.io
Summary
by MITRE • 11/04/2026
draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in draw.io prior to version 30.3.8 represents a critical server-side request forgery flaw within the optional /proxy endpoint. Draw.io functions as a configurable diagramming and whiteboarding application, often deployed in enterprise environments where it may interact with internal services or handle sensitive data visualizations. The core issue stems from an incomplete blocklist used by the URL validator when processing requests directed to this proxy endpoint. While the application attempts to mitigate server-side request forgery attacks by restricting which URLs can be fetched on behalf of the user, the validation logic fails to account for a specific range of private IP addresses defined in RFC 6598, specifically the shared address space 100.64.0.0/10. This oversight allows an attacker to bypass existing security controls by targeting internal infrastructure that resides within this particular subnet.
From a technical perspective, the flaw enables an unauthenticated remote attacker to manipulate the draw.io server into making HTTP requests to arbitrary destinations within the 100.64.0.0/10 range. In modern network architectures, particularly those utilizing Carrier-Grade NAT (CGNAT), Kubernetes clusters, cloud environments, or overlay networks like VXLAN or Geneve, this IP space is frequently assigned to internal services that are not directly exposed to the public internet but remain accessible from within the same virtual private cloud or data center segment. By leveraging the proxy endpoint, an attacker can force the server to act as a pivot point, effectively bypassing network-level access controls and firewalls that might otherwise restrict direct external access to these internal resources. This capability allows for unauthorized discovery of internal services, potential exfiltration of sensitive configuration data, or further exploitation of vulnerabilities present in backend systems reachable via this address range.
The operational impact of this vulnerability is significant due to the broad scope of affected environments and the lack of authentication requirements. An unauthenticated attacker can initiate these requests without any prior credentials, lowering the barrier for entry significantly. The disclosure of data from Carrier-Grade NAT addresses could reveal internal network topology or user-specific information tied to shared IP allocations. In Kubernetes environments, this could lead to access to service discovery endpoints or metadata services that expose cluster configuration details. Similarly, in cloud deployments, it may allow interaction with instance metadata services or internal load balancers, potentially leading to further compromise of the underlying infrastructure. The vulnerability essentially transforms a diagramming tool into an SSRF proxy capable of probing and interacting with sensitive internal assets.
This issue aligns with CWE-918, which classifies Server-Side Request Forgery (SSRF) flaws where server-side code makes requests from a back-end system using user-supplied input without sufficient validation to prevent access to restricted resources. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1557, specifically sub-technique T1557.001 for Adversary-in-the-Middle or Lateral Movement via SSRF, as it allows an attacker to use a trusted internal service to reach other internal targets that would otherwise be inaccessible. The failure to validate against the RFC 6598 shared address space highlights a common gap in URL validation logic where developers may focus on blocking private ranges like 10.x.x.x or 172.16.x.x but neglect less commonly targeted blocks such as 100.64.0.0/10, which are increasingly prevalent due to IPv4 address exhaustion and the rise of CGNAT deployments.
To mitigate this vulnerability, organizations must immediately upgrade draw.io to version 30.3.8 or later, where the URL validator has been corrected to properly reject requests targeting the RFC 6598 shared address range. For environments that cannot update immediately due to dependency constraints, it is advisable to disable the /proxy endpoint if it is not strictly required for business operations. Additionally, network-level controls such as egress filtering should be implemented on the draw.io servers to restrict outbound connections to only those destinations necessary for application functionality. This defense-in-depth approach ensures that even if a vulnerability exists in the application logic, the blast radius of potential exploitation is contained by preventing unauthorized communication with internal services residing in restricted IP ranges.