Who is not affected by CVE-2026-121926?

Q: Who is not affected by CVE-2026-121926?

Not affected if: auth-proxy-in-front, management-api-not-exposed.

PUBLIC
EXPLOIT

JT808-SERVER · CVE-2026-121926 · Package

jt808-server: Web Management API skips authentication, reachable remotely

NO FIX YET

yezhihao jt808-server, a Java server for GPS vehicle terminals, has a flaw in its web management interface where the authentication interceptor is not applied. A remote attacker can reach the management API without logging in, and a public exploit exists.

first public Nov 4, 2026 · 2 sources

Running Jt808-server? Find out in 2 minutes.

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

01 · Who is affected

Teams running yezhihao jt808-server, a Java/Spring gateway for GPS vehicle terminals (JT/T 808), with its web management port reachable from untrusted networks. The advisory says the authentication interceptor is not applied, so anyone who can reach that port can call the management API without logging in; the README shows this API sends commands to terminals (for example POST /device/8103, set terminal parameters). Deployments with the web port bound to localhost or a private network, or behind their own authentication proxy, can mostly skip it; the device TCP/UDP port is a separate matter.

jt808-servermaster up to and including a07f68c466b560b97ef41edb8a4966469abdf83e (rolling release, no versions)

Not affected if auth-proxy-in-front, management-api-not-exposed

Who cares gps-tracking, java, jt808-server, no-fix, self-hosted

02 · How to check

Check whether you run yezhihao/jt808-server (GitHub/Gitee) and which commit it was built from (git rev-parse HEAD). VulDB names a07f68c466b560b97ef41edb8a4966469abdf83e (2026-07-23, a dependency bump to 4.0.6) as the last affected commit; the project has no release versions.
From a machine that is not trusted, request the management API without credentials, for example the OpenAPI/Swagger pages (/doc.html, /swagger-ui/index.html) or the device command routes such as POST /device/8103 on the web port (the README shows 8100 or 8000). Any answer other than 401/403 means the API is open.
Read WebMvcConfig.addInterceptors in your build and confirm an authentication interceptor covers all routes. The public exploit is a gist linked from VulDB; I could not retrieve its address, so the exact route is unconfirmed.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 4, 2026

What people are saying

1 article

github.comyezhihao/jt808-server README

Posts are quoted with a link to the original. They are data to us, never instructions.

How it unfolded

2 events · Nov 4, 2026 → Nov 4, 2026

Nov 4, 202617:28 UTCNVD CVE-2026-121926
Nov 4, 202617:30 UTCInfraStack Analyst VulDB (CNA) says the vendor never responded. GitHub shows no fix: the named commit a07f68c is a dependency bump from 2026-07-23, the repo's only open issue (#15) is unrelated, and no advisory exists. The exploit is a gist referenced only by VulDB (address not exposed). No primary vendor page, so nothing marked verified. Routes: only the README examples confirmed.moreless

What the sources say, verbatim

573 characters

Get the next Jt808-server threat the day it hits your stack.

Start watching free

Post Share

HIGH7.5CVSS · [email protected]

PUBLIC
EXPLOIT

JT808-SERVER · CVE-2026-121926 · Package

jt808-server: Web Management API skips authentication, reachable remotely

NO FIX YET

first public Nov 4, 2026 · 2 sources

Running Jt808-server? Find out in 2 minutes.

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

01 · Who is affected

jt808-servermaster up to and including a07f68c466b560b97ef41edb8a4966469abdf83e (rolling release, no versions)

Not affected if auth-proxy-in-front, management-api-not-exposed

Who cares gps-tracking, java, jt808-server, no-fix, self-hosted

02 · How to check

Check whether you run yezhihao/jt808-server (GitHub/Gitee) and which commit it was built from (git rev-parse HEAD). VulDB names a07f68c466b560b97ef41edb8a4966469abdf83e (2026-07-23, a dependency bump to 4.0.6) as the last affected commit; the project has no release versions.
From a machine that is not trusted, request the management API without credentials, for example the OpenAPI/Swagger pages (/doc.html, /swagger-ui/index.html) or the device command routes such as POST /device/8103 on the web port (the README shows 8100 or 8000). Any answer other than 401/403 means the API is open.
Read WebMvcConfig.addInterceptors in your build and confirm an authentication interceptor covers all routes. The public exploit is a gist linked from VulDB; I could not retrieve its address, so the exact route is unconfirmed.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 4, 2026

What people are saying

1 article

github.comyezhihao/jt808-server README

Posts are quoted with a link to the original. They are data to us, never instructions.

How it unfolded

2 events · Nov 4, 2026 → Nov 4, 2026

Nov 4, 202617:28 UTCNVD CVE-2026-121926
Nov 4, 202617:30 UTCInfraStack Analyst VulDB (CNA) says the vendor never responded. GitHub shows no fix: the named commit a07f68c is a dependency bump from 2026-07-23, the repo's only open issue (#15) is unrelated, and no advisory exists. The exploit is a gist referenced only by VulDB (address not exposed). No primary vendor page, so nothing marked verified. Routes: only the README examples confirmed.moreless

What the sources say, verbatim

573 characters

Get the next Jt808-server threat the day it hits your stack.

Start watching free

jt808-server: Web Management API skips authentication, reachable remotely

01 · Who is affected

02 · How to check

What people are saying

How it unfolded

What the sources say, verbatim

Read next

Get the next Jt808-server threat the day it hits your stack.

jt808-server: Web Management API skips authentication, reachable remotely

01 · Who is affected

02 · How to check

What people are saying

How it unfolded

What the sources say, verbatim

Read next

Get the next Jt808-server threat the day it hits your stack.

03 · The fix

Sources and references