Next AI Draw.io CVE-2026-72777

The POST /api/parse-url endpoint must be network-reachable by the attacker; no authentication is required per CVSS PR:N. No special configuration is needed - the vulnerable code path is part of default application functionality. The primary limiting factor is deployment footprint: this is a niche open-source project, and instances exposed to the public internet or untrusted networks are the practical target population. Impact is most severe in cloud environments where IMDSv1 is enabled and reachable from the application host, or where the application can reach sensitive internal HTTP services. On-premises deployments with no sensitive internal HTTP endpoints still allow SSRF but with reduced blast radius.

The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N scores the vulnerable-system impact as nil and the subsequent-system confidentiality impact as High, which accurately reflects the SSRF threat model: the vulnerable application itself is not directly compromised, but downstream internal systems - most critically cloud instance metadata services - are exposed. No attack requirements, no privileges, and no user interaction are necessary, making the endpoint trivially exploitable from the network. A publicly available exploit exists per VulnCheck, which elevates practical risk above the base vector alone. No EPSS score was provided in the intelligence data, and the vulnerability is not listed in CISA KEV, so active mass-exploitation is not confirmed. However, the cloud metadata exfiltration scenario is severe in cloud-hosted deployments: successful SSRF against IMDSv1 can yield IAM credentials, enabling full cloud account compromise as a secondary impact far beyond the CVSS score suggests. Real-world risk is therefore HIGH for any cloud-deployed instance of this product, and low-to-moderate for on-premises deployments without sensitive internal HTTP services.

An unauthenticated attacker sends a POST request to /api/parse-url with a payload hostname that bypasses the string-pattern denylist - for example, a domain under the attacker's control that resolves to 169.254.169.254 (AWS IMDSv1). The server fetches the attacker-specified URL, resolves it to the internal metadata address, and returns the response body (including IAM credentials) to the attacker. A publicly available proof-of-concept exists per VulnCheck, lowering the skill threshold for exploitation.