CVE-2026-97373 · Package
NO FIX YET · SEE WHAT TO DO
draw.io, a diagramming application, has an optional /proxy endpoint whose URL check misses the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can make the draw.io server request internal services in that range and may read the responses.
first public Jul 14, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only deployments where the optional /proxy endpoint is enabled are exposed, since the URL validator is the flawed part. The sources say the attacker reaches services in 100.64.0.0/10 from the draw.io server, so self-hosted instances on networks with Carrier-Grade NAT, Kubernetes or overlay addresses are the ones to look at. Instances without the proxy endpoint enabled can skip it.
Not affected if managed-hosting, proxy-endpoint-disabled
Who cares draw.io, kubernetes, self-hosted
Unknown from the sources.
30.3.8 or later.draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.