JeecgBoot: Server-Side Request Forgery in RestTemplate (CVE-2026-126997)
A server-side request forgery vulnerability in JeecgBoot versions up to 3.9.6 allows remote attackers to trigger unauthorized requests via the RestTemplate.exchange function.
CVE search metadata
CVE search record: CVE-2026-126997. Severity: high. CVSS: 7.3. KEV: no. Product: JeecgBoot (<= 3.9.6). Brief: JeecgBoot: Server-Side Request Forgery in RestTemplate (CVE-2026-126997). Brief link: https://feed.craftedsignal.io/briefs/2026-11-jeecgboot-ssrf-cve-2026-126997/
Triage facts
Revision 1- Applicability
- JeecgBoot (<= 3.9.6)
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 18:45 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A server-side request forgery (SSRF) vulnerability has been identified in JeecgBoot versions up to 3.9.6. The flaw exists within the RestTemplate.exchange function located in the org/jeecg/modules/airag/flow/c/a.class file of the flow-run component. Remote exploitation is possible, and public exploit code is available. The vendor did not respond to disclosure attempts.