{"id":"CVE-2026-126997","kind":"vulnerability","aliases":["CVE-2026-126997"],"related":[],"title":"JeecgBoot: flow-run endpoint lets a remote caller forge server-side requests","description":"A vulnerability was identified in JeecgBoot up to 3.9.6. This affects the function RestTemplate.exchange of the file org/jeecg/modules/airag/flow/c/a.class of the component flow-run Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"NVD lists JeecgBoot up to 3.9.6 as having a server-side request forgery in the airag flow-run endpoint (RestTemplate.exchange). A remote caller can make the server send requests to addresses of their choosing. The vendor reportedly did not respond, and no fixed version is known.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"JeecgBoot","fixed":[],"affected":"<= 3.9.6","ecosystem":"maven"}],"ecosystems":[],"tags":["java","jeecgboot","package","self-hosted"],"not_affected_if":["airag-module-not-deployed"],"how_to_check":"Check your JeecgBoot version: 3.9.6 (released 5 Nov 2026) and earlier are listed as affected. Check whether the airag module (/airag/ paths, AI flow orchestration) is deployed and reachable. Whether the flow-run endpoint needs a login is not stated in any source I found, so restrict access to it at the gateway or firewall until you know.","fix":null,"status":"open","published_at":"2026-11-12T15:17:49+00:00","first_seen_at":"2026-11-12T15:41:57+00:00","triaged_at":"2026-11-12T15:43:47+00:00","updated_at":"2026-11-12T15:45:14+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-12T15:43:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"JeecgBoot: flow-run endpoint lets a remote caller forge server-side requests","impact":"medium","summary":"JeecgBoot up to version 3.9.6 has a server-side request forgery flaw in its flow-run endpoint, in the RestTemplate.exchange call. A remote attacker can make the server send requests to addresses of their choosing, which can reach internal services.","audience":"businesses","category":"package","nicknames":[],"who_cares":["jeecgboot","java","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"server reaches internal services and returns their responses to attacker","analyst_note":"Confirm whether the flow-run endpoint requires authentication, whether the airag module is on by default, and whether a fixed JeecgBoot version exists; check the NVD entry and the vendor's release notes.","how_to_check":"- Check the installed JeecgBoot version against `3.9.6`.\n- Look for the flow-run endpoint (airag flow) in the deployed application.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"JeecgBoot deployments up to and including 3.9.6 that expose the flow-run endpoint in the airag module are the ones to look at. The sources do not say whether the flaw needs an account or a non-default feature, so treat any reachable instance as potentially exposed until the version is confirmed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4587,"output_tokens":547,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether the flow-run endpoint requires authentication, whether the airag module is on by default, and whether a fixed JeecgBoot version exists; check the NVD entry and the vendor's release notes.","search":"'-126997':17A,20A '-2026':16A,19A '3.9.6':33B,84C 'address':60B 'affect':86C 'airag':44B 'attack':114C 'avail':121C 'caller':9A,52B 'choos':63B 'compon':96C 'contact':129C 'cve':15A,18A 'disclosur':133C 'earli':130C 'endpoint':5A,48B,100C 'exploit':111C,118C 'file':92C 'fix':72B 'flow':3A,46B,98C 'flow-run':2A,45B,97C 'forg':10A 'forgeri':41B,109C 'function':88C 'host':27B 'identifi':79C 'java':22B 'jeecgboot':1A,21A,23B,30B,81C 'known':75B 'lead':103C 'let':6A 'list':29B 'make':54B 'manipul':102C 'might':123C 'nvd':28B 'org/jeecg/modules/airag/flow/c/a.class':93C 'packag':24B 'possibl':116C 'public':120C 'remot':8A,51B,110C 'report':66B 'request':14A,40B,58B,108C 'respond':69B,137C 'resttemplate.exchange':49B,89C 'run':4A,47B,99C 'self':26B 'self-host':25B 'send':57B 'server':12A,38B,56B,106C 'server-sid':11A,37B,105C 'side':13A,39B,107C 'use':125C 'vendor':65B,127C 'version':73B 'vulner':77C 'way':140C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted JeecgBoot deployments up to and including 3.9.6 that include the airag AI flow module. NVD says the attack is remote, and its CVSS 4.0 vector shows no privileges required, but I found no maintainer text that confirms the endpoint is reachable without login. Teams that do not deploy airag, or that block outbound requests from the app server to internal addresses, are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["jeecgboot"],"ptokens":["jeecgboot"],"labels":["high","java","jeecgboot","package","selfhosted"],"campaign_type":null,"search_a":"'-126997':17A,20A '-2026':16A,19A 'caller':9A 'cve':15A,18A 'endpoint':5A 'flow':3A 'flow-run':2A 'forg':10A 'jeecgboot':1A,21A 'let':6A 'remot':8A 'request':14A 'run':4A 'server':12A 'server-sid':11A 'side':13A","search_b":"'3.9.6':33B 'address':60B 'airag':44B 'caller':52B 'choos':63B 'endpoint':48B 'fix':72B 'flow':46B 'flow-run':45B 'forgeri':41B 'host':27B 'java':22B 'jeecgboot':23B,30B 'known':75B 'list':29B 'make':54B 'nvd':28B 'packag':24B 'remot':51B 'report':66B 'request':40B,58B 'respond':69B 'resttemplate.exchange':49B 'run':47B 'self':26B 'self-host':25B 'send':57B 'server':38B,56B 'server-sid':37B 'side':39B 'vendor':65B 'version':73B","search_c":"'3.9.6':84C 'affect':86C 'attack':114C 'avail':121C 'compon':96C 'contact':129C 'disclosur':133C 'earli':130C 'endpoint':100C 'exploit':111C,118C 'file':92C 'flow':98C 'flow-run':97C 'forgeri':109C 'function':88C 'identifi':79C 'jeecgboot':81C 'lead':103C 'manipul':102C 'might':123C 'org/jeecg/modules/airag/flow/c/a.class':93C 'possibl':116C 'public':120C 'remot':110C 'request':108C 'respond':137C 'resttemplate.exchange':89C 'run':99C 'server':106C 'server-sid':105C 'side':107C 'use':125C 'vendor':127C 'vulner':77C 'way':140C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126997","severity":null,"published_at":"2026-11-12T15:17:49+00:00","modified_at":"2026-11-12T15:17:49+00:00","first_seen_at":"2026-11-12T15:41:57+00:00","fetched_at":"2026-11-12T15:41:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126997:3750","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126997","severity":null,"published_at":"2026-11-12T15:45:14+00:00","modified_at":"2026-11-12T15:45:14+00:00","first_seen_at":"2026-11-12T15:45:14+00:00","fetched_at":"2026-11-12T15:45:14+00:00","note":"NVD only: no maintainer advisory or issue for this flow-run SSRF found. Vendor reportedly did not respond. v3.9.6 (5 Nov) is the latest release and is itself listed as affected, so no fixed version is known. Earlier airag SSRFs (/airag/chat/send, airagModel/test) were different issues. Auth and default-on status unconfirmed. Nothing verified.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-126997","https://github.com/jeecgboot/JeecgBoot/releases"]}],"documents":[{"id":136121,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126997","title":"NVD CVE-2026-126997","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":105306,"url":"https://github.com/jeecgboot/JeecgBoot/releases","title":"JeecgBoot releases (v3.9.6, 5 Nov)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}