---
id: "CVE-2026-126998"
page: "https://infrastack.ai/live/CVE-2026-126998"
kind: "vulnerability"
aliases: ["CVE-2026-126998"]
title: "JeecgBoot: authentication filter flaw lets remote users trigger server-side requests"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "jeecg-boot", "fixed": [], "affected": "<= 3.9.5", "ecosystem": "maven"}]
ecosystems: []
tags: ["java", "jeecgboot", "other", "self-hosted", "ssrf"]
not_affected_if: ["endpoint-blocked", "internal-only", "newer-version"]
published_at: "2026-11-12T15:17:49+00:00"
first_seen_at: "2026-11-12T15:41:57+00:00"
updated_at: "2026-11-12T15:45:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126998", "first_seen_at": "2026-11-12T15:41:57+00:00"}, {"source": "analyst", "url": "https://github.com/jeecgboot/JeecgBoot/issues/9705", "first_seen_at": "2026-11-12T15:45:13+00:00", "cites": ["https://github.com/jeecgboot/JeecgBoot/issues/9705", "https://github.com/jeecgboot/JeecgBoot/releases/tag/v3.9.6", "https://github.com/jeecgboot/JeecgBoot/issues/9726"]}]
exploit_sources: []
---

# JeecgBoot: authentication filter flaw lets remote users trigger server-side requests

Link for people: https://infrastack.ai/live/CVE-2026-126998 (this .md is for agents)

JeecgBoot up to version 3.9.5 has a server-side request forgery flaw in its OpenAPI call endpoint (/openapi/call). A remote attacker can make the server send requests to addresses of the attacker's choosing, which can reach internal services.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:jeecg-boot affected <= 3.9.5 fixed no fixed version listed

## How to check

- Check the JeecgBoot version: 3.9.5 or earlier is in range per NVD; 3.9.6 is the latest release but is not confirmed as the fix for this CVE.
- /openapi/call/{path} is not behind the normal login token (issue #9705 describes it as publicly accessible, with only an AK header check), so test whether it is reachable from the internet or untrusted networks.
- Review stored OpenAPI entries (originUrl) for internal addresses (127.0.0.1, 169.254.169.254, RFC1918).
- Stopgap: block /openapi/call at the proxy if you do not use OpenAPI integrations, and block egress from the app to metadata and internal ranges.

## Fix

No fix is named for this CVE. The vendor did not respond to the reporter (per NVD). JeecgBoot v3.9.6 (2026-11-05) is the latest release and a security release (67 fixes, SSRF hardening) but its notes do not name this CVE or /openapi/call. Upgrade to 3.9.6 and retest; also see the 3.9.6 upgrade notes about the cleared demo AK/SK.

## Timeline

- 2026-11-12T15:41:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126998
- 2026-11-12T15:45:13+00:00 analyst https://github.com/jeecgboot/JeecgBoot/issues/9705 — NVD/VulDB only; vendor silent per NVD, no advisory for this CVE id found. Related older OpenAPI SSRFs (CVE-2026-7604, issues 9432/9554/9695/9726/9705) are fixed in part across 3.9.x; v3.9.6 notes list 67 fixes incl. SSRF but do not name this CVE, so fix not verified and nothing marked verified. No public PoC link found; X not checked. Possible duplicate/sibling of CVE-2026-7604 and GHSA-fvq7-vj2h-wmm9.

## Documents

- [describes] JeecgBoot #9705: /openapi/call publicly accessible, AK-only check https://github.com/jeecgboot/JeecgBoot/issues/9705
- [fix] JeecgBoot v3.9.6 release notes (67 security fixes) https://github.com/jeecgboot/JeecgBoot/releases/tag/v3.9.6
- [mentions] JeecgBoot #9726: stored SSRF via OpenAPI originUrl (v3.9.2) https://github.com/jeecgboot/JeecgBoot/issues/9726

## From the sources

A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /openapi/call of the component Authentication Filter. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_