JeecgBoot: Server-Side Request Forgery in OpenApiController (CVE-2026-126998)
JeecgBoot versions up to 3.9.5 contain a server-side request forgery (SSRF) vulnerability in the /openapi/call endpoint.
CVE search metadata
CVE search record: CVE-2026-126998. Severity: high. CVSS: 7.3. KEV: no. Product: JeecgBoot (<= 3.9.5). Brief: JeecgBoot: Server-Side Request Forgery in OpenApiController (CVE-2026-126998). Brief link: https://feed.craftedsignal.io/briefs/2026-11-jeecgboot-ssrf-cve-2026-126998/
Triage facts
Revision 1- Applicability
- JeecgBoot (<= 3.9.5)
- Evidence
- Not observed
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 20:49 UTC
- Detection
- 1 rule
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
JeecgBoot up to 3.9.5 is affected by a security flaw in the OpenApiController.call function, located at /openapi/call within the Authentication Filter component. This vulnerability results in server-side request forgery (SSRF) and can be executed remotely. A public exploit is available for this vulnerability.
Detection coverage 1
Detect CVE-2026-126998 Exploitation - SSRF via OpenApiController
highDetects access to the vulnerable /openapi/call endpoint.
Detection queries are available on the platform. Get full rules →