CVE-2026-129485

CVSS 6.9 (medium) · published 2026-11-15

Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unauthenticated attackers to make server requests via node icon and background attributes. Attackers can send crafted diagrams to POST /blockdiag/svg or sibling endpoints to query internal services or cloud metadata and read local image files from the server.

Weakness: CWE-918

Source: NVD CVE-2026-129485

References

• https://github.com/yuzutech/kroki/blob/v0.35.0/server/src/main/java/io/kroki/server/service/Blockdiag.java#L64-L85
• https://github.com/yuzutech/kroki/commit/becd3b4a86754cb08d0fe54f65e92a6cab542409
• https://github.com/yuzutech/kroki/releases/tag/v0.36.0
• https://github.com/yuzutech/kroki/security/advisories/GHSA-jwh8-j584-79hp
• https://www.vulncheck.com/advisories/kroki-before-0.36.0-ssrf-via-blockdiag-icon-and-background-attributes

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.