CVE-2026-19000 Server-Side Request Forgery in JeecgBoot

A server-side request forgery (SSRF) vulnerability, identified as CVE-2026-19000, has been disclosed in JeecgBoot versions up to 3.9.2. The vulnerability resides within the Anonymous Chat Attachment Parser component, specifically in an undocumented function associated with the /airag/chat/send endpoint. Remote, unauthenticated attackers can exploit this flaw to induce the application server to perform unauthorized HTTP requests to internal or external resources. Given the availability of public exploit material, there is a risk of active exploitation for reconnaissance or interaction with internal services that are not directly exposed to the internet. Defenders should prioritize patching or restricting access to the affected endpoint until a vendor-supplied update is available.

Impact

Successful exploitation of this SSRF vulnerability may allow attackers to bypass network perimeter controls to scan internal networks, retrieve sensitive metadata from cloud environments (e.g., IMDS), or interact with internal APIs that rely on implicit trust. This represents a significant risk for organizations hosting JeecgBoot in environments with sensitive internal network segments or cloud-native infrastructure.

Recommendation

• Deploy the provided Sigma rule to detect attempts to reach the vulnerable endpoint.
• Implement strict firewall or web application firewall (WAF) rules to restrict access to the /airag/chat/send endpoint if it is not required for business operations.
• Monitor server access logs for anomalous outbound HTTP requests originating from the JeecgBoot server process.
• Upgrade JeecgBoot to the latest version once a fix is released.