CVE-2026-126998— JeecgBoot Authentication Filter call OpenApiController.call server-side request forgery
Quick assessment
Affected
n/a JeecgBoot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /openapi/call of the component Authentication Filter. The manipulation results in server-side request forgery. The attack c
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-126998
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JeecgBoot Authentication Filter call OpenApiController.call server-side request forgery
Source: CVE Program / CVE List V5
Vulnerability Description
A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /openapi/call of the component Authentication Filter. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | JeecgBoot | 3.9.0 |
cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-126998
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-126998
请登录查看更多情报信息。
Other References for CVE-2026-126998 (1)
-
CVE-2026-126998 | JeecgBoot up to 3.9.5 Authentication Filter /openapi/call OpenApiController.call server-side request forgery vdb-entry technical-description
Other References for CVE-2026-126998 (4)
-
https://vuldb.com/cve/CVE-2026-126998 third-party-advisory
-
-
https://vuldb.com/submit/1040929 third-party-advisory
Same Patch Batch · n/a · 2026-11-12 · 56 CVEs total
| CVE-2026-116331 | 8.8 HIGH | PostgreSQL min/max aggregate type confusion executes arbitrary code |
| CVE-2026-116307 | 8.8 HIGH | PostgreSQL plperl prepared-query use-after-free executes arbitrary code |
| CVE-2026-116309 | 8.8 HIGH | PostgreSQL plperl blessed-reference type confusion may execute arbitrary code |
| CVE-2026-120142 | 8.8 HIGH | PostgreSQL dropped-column type confusion executes arbitrary code |
| CVE-2026-120141 | 8.8 HIGH | PostgreSQL materialized set-returning function type confusion executes arbitrary code |
| CVE-2026-120139 | 8.8 HIGH | PostgreSQL tuple-size integer wraparound executes arbitrary code |
| CVE-2026-116336 | 8.8 HIGH | PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during index functions |
| CVE-2026-116335 | 8.8 HIGH | PostgreSQL commutator or negator result-type confusion executes arbitrary code |
| CVE-2026-116332 | 8.8 HIGH | PostgreSQL portal setup use-after-free executes arbitrary code |
| CVE-2026-116315 | 8.8 HIGH | PostgreSQL tsvector_delete() heap buffer overflow executes arbitrary code |
| CVE-2026-120144 | 8.8 HIGH | PostgreSQL type-cache invalidation gap executes arbitrary code |
| CVE-2026-116329 | 8.8 HIGH | PostgreSQL statistics import type confusion executes arbitrary code |
| CVE-2026-116330 | 8.8 HIGH | PostgreSQL pg_dump tar restore.sql fails to block psql command injection |
| CVE-2026-116328 | 8.8 HIGH | PostgreSQL generation memory context integer wraparound executes arbitrary code |
| CVE-2026-116317 | 8.8 HIGH | PostgreSQL ts_rank_cd() heap buffer overflow may execute arbitrary code |
| CVE-2026-116326 | 8.8 HIGH | PostgreSQL plperl tied-object exceptions follow stale sigjmp_buf |
| CVE-2026-116323 | 8.8 HIGH | PostgreSQL pltcl reentrant result conversion use-after-free executes arbitrary code |
| CVE-2026-116319 | 8.8 HIGH | PostgreSQL plperl reentrant return_next() use-after-free executes arbitrary code |
| CVE-2026-116320 | 8.8 HIGH | PostgreSQL plperl array and hash conversion use-after-free executes arbitrary code |
| CVE-2026-116318 | 8.8 HIGH | PostgreSQL pg_dump not-null constraint name allows SQL injection |
Showing top 20 of 56 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: JeecgBoot
-
CVE-2026-126997
JeecgBoot flow-run Endpoint a.class RestTemplate.exchange se -
CVE-2026-124555
JeecgBoot Table Dictionary API getTableDictList JimuFormApiS -
CVE-2026-124554
JeecgBoot JimuBI getAllChartData sql injection -
CVE-2026-112017
JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Ne -
CVE-2026-108891
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/
Same vendor: n/a
-
CVE-2026-126997
JeecgBoot flow-run Endpoint a.class RestTemplate.exchange se -
CVE-2026-6467
PostgreSQL extension script schema mishandling executes arbi -
CVE-2026-6460
PostgreSQL type confusion after ALTER ... SET DATA TYPE exec -
CVE-2026-18447
PostgreSQL output parameter type confusion executes arbitrar -
CVE-2026-16240
PostgreSQL pg_basebackup can use backup manifest content as
Same weakness: CWE-918
-
CVE-2026-126997
JeecgBoot flow-run Endpoint a.class RestTemplate.exchange se -
CVE-2026-77738
Synology DSM 7.3.2/7.4.1 Credential API SSRF 漏洞 -
CVE-2026-67545
Heym: Server-Side Request Forgery (SSRF) in HTTP Workflow No -
CVE-2026-67542
Heym: SSRF via POST /api/mcp/fetch-tools: any authenticated -
CVE-2026-103980
ideon: SSRF protection bypass via IPv6 transition addresses