JEECGBOOT · CVE-2026-126997 · Package
NO FIX YET
NVD lists JeecgBoot up to 3.9.6 as having a server-side request forgery in the airag flow-run endpoint (RestTemplate.exchange). A remote caller can make the server send requests to addresses of their choosing. The vendor reportedly did not respond, and no fixed version is known.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted JeecgBoot deployments up to and including 3.9.6 that include the airag AI flow module. NVD says the attack is remote, and its CVSS 4.0 vector shows no privileges required, but I found no maintainer text that confirms the endpoint is reachable without login. Teams that do not deploy airag, or that block outbound requests from the app server to internal addresses, are lower risk.
Not affected if airag-module-not-deployed
Who cares java, jeecgboot, self-hosted
3.9.6 (released 5 Nov 2026) and earlier are listed as affectedNo fix yet, per the sources.
A vulnerability was identified in JeecgBoot up to 3.9.6. This affects the function RestTemplate.exchange of the file org/jeecg/modules/airag/flow/c/a.class of the component flow-run Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.