JEECG-BOOT · CVE-2026-126998 · Other
NO FIX YET · SEE WHAT TO DO
JeecgBoot up to version 3.9.5 has a server-side request forgery flaw in its OpenAPI call endpoint (/openapi/call). A remote attacker can make the server send requests to addresses of the attacker's choosing, which can reach internal services.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted JeecgBoot deployments at 3.9.5 or earlier that expose the OpenAPI module's /openapi/call endpoint. Earlier public issues show the endpoint skips the normal login filter and forwards requests to a stored URL, so a server reachable from the internet can be made to call internal hosts such as cloud metadata. Teams on managed or private-only deployments with the endpoint blocked can mostly skip it.
Not affected if endpoint-blocked, internal-only, newer-version
Who cares java, jeecgboot, self-hosted, ssrf
v3.9.6 (2026-11-05) is the latest release and a security release (67 fixes, SSRF hardening) but its notes do not name this CVE or /openapi/callPosts are quoted with a link to the original. They are data to us, never instructions.
A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /openapi/call of the component Authentication Filter. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
3.9.6 and retest; also see the 3.9.6 upgrade notes about the cleared demo AK/SKNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.