draw.io CVE-2026-63334

Requires a draw.io server deployment started with the environment variable ENABLE_DRAWIO_PROXY=1, which activates the ProxyServlet image proxy - installs without this flag, as well as the SaaS and desktop editions, are not exposed. Exploitation is unauthenticated and remote against that proxy endpoint, but is LIMITED by a DNS-rebinding timing race: the attacker-controlled hostname must resolve to a permitted public address during Utils.sanitizeUrl() validation and then to a private, link-local, or 169.254.169.254 cloud-metadata address by the time URL.openConnection() performs the second resolution (hence CVSS AC:H). Impact is highest when the server runs in a cloud environment with a reachable instance metadata service or internal-only HTTP services; it is read-only (no integrity or availability impact).

This is a legitimate but conditional SSRF, not a high-severity emergency. The CVSS 3.1 vector (6.8, AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) is internally consistent with the DNS-rebinding root cause: AV:N because the proxy endpoint is network-reachable, PR:N because draw.io's image proxy is typically unauthenticated, AC:H because success requires winning a DNS time-of-check/time-of-use race (the hostname must resolve public during Utils.sanitizeUrl() and private/link-local/metadata during URL.openConnection()), S:C because attacker reads data from separate internal/cloud-metadata systems, and C:H/I:N/A:N because the payoff is read-only exfiltration of cloud instance metadata or internal HTTP responses with no write or availability impact. No EPSS score, no CISA KEV listing, and no public exploit are present in the supplied intelligence, so this is 'no public exploit identified at time of analysis.' The strongest mitigating signal is the gating condition: only deployments running with ENABLE_DRAWIO_PROXY=1 are affected, which narrows the exposed population well below the raw popularity of draw.io. Net: patch on a normal cycle for self-hosted proxy-enabled instances, especially those in cloud (IMDS-reachable) environments; treat it as lower priority for SaaS/desktop users and installs with the proxy disabled. No conflicting signals were found between the CVSS vector and the description - both agree on unauthenticated network access with a rebinding race.

An attacker registers a hostname under their control whose DNS record flips between a public IP and 169.254.169.254 (cloud metadata) or an internal RFC1918 address, then submits it to a self-hosted draw.io instance's image proxy (ENABLE_DRAWIO_PROXY=1). The first resolution passes the private-address allow check, but by the time ProxyServlet calls URL.openConnection() the record has flipped, so the proxy fetches internal or metadata content and returns it to the attacker. No public exploit is identified, and the AC:H rating reflects the DNS timing race that must be won.