CVE-2026-72777 is a server-side request forgery vulnerability affecting Next AI Draw.io through version 0.4.16. The flaw exists in the POST /api/parse-url endpoint where hostname validation is insufficient, relying solely on string pattern checks without DNS resolution. Attackers can exploit this by providing hostnames that appear valid but resolve to internal IP addresses, allowing them to make unauthorized requests to internal services and potentially exfiltrate sensitive information including cloud metadata. The vulnerability is unauthenticated and has a CVSS 4.0 base score of 7.7, indicating high severity. No official remediation or patch has been documented as of the published date.

An unauthenticated attacker can exploit this vulnerability to perform SSRF attacks, reaching arbitrary internal HTTP services that are otherwise inaccessible externally. This can lead to unauthorized data access, including sensitive internal resources and cloud metadata, which may facilitate further attacks or information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to internal services from the application server and implement additional validation or filtering on user-supplied hostnames to prevent resolution to internal IP addresses.