{"id":"CVE-2026-129485","kind":"vulnerability","aliases":["CVE-2026-129485"],"related":[],"title":"Kroki: unauthenticated SSRF via BlockDiag diagrams reaches internal services","description":"Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unauthenticated attackers to make server requests via node icon and background attributes. Attackers can send crafted diagrams to POST /blockdiag/svg or sibling endpoints to query internal services or cloud metadata and read local image files from the server.","summary":"Kroki before 0.36.0 lets an unauthenticated attacker send a crafted BlockDiag diagram whose node icon or background attributes make the server issue requests. An attacker can use this to query internal services or cloud metadata and read local image files.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"kroki","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloud-metadata","kroki","package","self-hosted"],"not_affected_if":["managed-hosting","version-0.36.0-or-later"],"how_to_check":"- Check the running Kroki version: `kroki --version` or the image tag in your deployment, and see whether it is below `0.36.0`.\n- Check whether the BlockDiag endpoints (`POST /blockdiag/svg` and sibling endpoints) are reachable from untrusted networks.","fix":"- Kroki: move to `0.36.0` or later.","status":"open","published_at":"2026-11-15T16:16:56+00:00","first_seen_at":"2026-11-15T16:35:38+00:00","triaged_at":"2026-11-15T16:37:11+00:00","updated_at":"2026-11-15T16:37:11+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-15T16:37:11Z","model":"claude-haiku-5-5","output":{"fix":"- Kroki: move to `0.36.0` or later.","reach":"internet","title":"Kroki: unauthenticated SSRF via BlockDiag diagrams reaches internal services","impact":"medium","summary":"Kroki before 0.36.0 lets an unauthenticated attacker send a crafted BlockDiag diagram whose node icon or background attributes make the server issue requests. An attacker can use this to query internal services or cloud metadata and read local image files.","audience":"businesses","category":"package","nicknames":[],"who_cares":["kroki","self-hosted","cloud-metadata"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"server reads cloud metadata and local image files","analyst_note":"","how_to_check":"- Check the running Kroki version: `kroki --version` or the image tag in your deployment, and see whether it is below `0.36.0`.\n- Check whether the BlockDiag endpoints (`POST /blockdiag/svg` and sibling endpoints) are reachable from untrusted networks.","plain_action":"","product_name":"kroki","needs_analyst":false,"not_affected_if":["managed-hosting","version-0.36.0-or-later"],"who_is_affected":"Teams that run Kroki themselves and expose its diagram rendering endpoints, especially where the server can reach internal services or cloud metadata endpoints. Instances that are not reachable from untrusted networks, or that are running `0.36.0` or later, are not affected by this flaw.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4643,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129485':12A,15A '-2026':11A,14A '/blockdiag/svg':103C '0.36.0':27B,67C 'allow':83C 'attack':31B,49B,85C,96C 'attribut':42B,95C 'background':41B,94C 'blockdiag':5A,35B,78C 'cloud':18B,58B,112C 'cloud-metadata':17B 'contain':68C 'craft':34B,99C 'cve':10A,13A 'diagram':6A,36B,100C 'endpoint':106C 'engin':81C 'famili':79C 'file':64B,118C 'forgeri':74C 'host':24B 'icon':39B,92C 'imag':63B,117C 'intern':8A,55B,109C 'issu':46B 'kroki':1A,16A,20B,25B,65C 'let':28B 'local':62B,116C 'make':43B,87C 'metadata':19B,59B,113C 'node':38B,91C 'packag':21B 'post':102C 'queri':54B,108C 'reach':7A 'read':61B,115C 'request':47B,73C,89C 'self':23B 'self-host':22B 'send':32B,98C 'server':45B,71C,88C,121C 'server-sid':70C 'servic':9A,56B,110C 'sibl':105C 'side':72C 'ssrf':3A 'unauthent':2A,30B,84C 'use':51B 'via':4A,90C 'vulner':75C 'whose':37B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Kroki themselves and expose its diagram rendering endpoints, especially where the server can reach internal services or cloud metadata endpoints. Instances that are not reachable from untrusted networks, or that are running `0.36.0` or later, are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["kroki"],"ptokens":["kroki"],"labels":["cloudmetadata","kroki","medium","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-129485':12A,15A '-2026':11A,14A 'blockdiag':5A 'cve':10A,13A 'diagram':6A 'intern':8A 'kroki':1A,16A 'reach':7A 'servic':9A 'ssrf':3A 'unauthent':2A 'via':4A","search_b":"'0.36.0':27B 'attack':31B,49B 'attribut':42B 'background':41B 'blockdiag':35B 'cloud':18B,58B 'cloud-metadata':17B 'craft':34B 'diagram':36B 'file':64B 'host':24B 'icon':39B 'imag':63B 'intern':55B 'issu':46B 'kroki':20B,25B 'let':28B 'local':62B 'make':43B 'metadata':19B,59B 'node':38B 'packag':21B 'queri':54B 'read':61B 'request':47B 'self':23B 'self-host':22B 'send':32B 'server':45B 'servic':56B 'unauthent':30B 'use':51B 'whose':37B","search_c":"'/blockdiag/svg':103C '0.36.0':67C 'allow':83C 'attack':85C,96C 'attribut':95C 'background':94C 'blockdiag':78C 'cloud':112C 'contain':68C 'craft':99C 'diagram':100C 'endpoint':106C 'engin':81C 'famili':79C 'file':118C 'forgeri':74C 'icon':92C 'imag':117C 'intern':109C 'kroki':65C 'local':116C 'make':87C 'metadata':113C 'node':91C 'post':102C 'queri':108C 'read':115C 'request':73C,89C 'send':98C 'server':71C,88C,121C 'server-sid':70C 'servic':110C 'sibl':105C 'side':72C 'unauthent':84C 'via':90C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:56:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129485","severity":null,"published_at":"2026-11-15T16:16:56+00:00","modified_at":"2026-11-15T16:16:56+00:00","first_seen_at":"2026-11-15T16:35:38+00:00","fetched_at":"2026-11-15T16:35:38+00:00","note":null}],"documents":[{"id":164392,"url":"https://github.com/yuzutech/kroki/commit/becd3b4a86754cb08d0fe54f65e92a6cab542409","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":157578,"url":"https://github.com/yuzutech/kroki/releases/tag/v0.36.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":164394,"url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-jwh8-j584-79hp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-09T17:56:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":164395,"url":"https://www.vulncheck.com/advisories/kroki-before-0.36.0-ssrf-via-blockdiag-icon-and-background-attributes","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}