CVE-2026-126997: JeecgBoot flow-run Endpoint a.class RestTemplate.exchange server-side request forgery
A vulnerability was identified in JeecgBoot up to 3.9.6. This affects the function RestTemplate.exchange of the file org/jeecg/modules/airag/flow/c/a.class of the component flow-run Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Which deployments should be prioritized for investigation?
JeecgBoot deployments running version 3.9.6 or earlier should be prioritized, particularly where the flow-run endpoint is reachable by remote users or can reach internal network services.
Does exploiting this issue require authentication or user interaction?
No. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction.
Is public exploit code available?
Yes. The vulnerability data flags a proof of concept, and the description states that a public exploit is available.
What can be done if an update is not immediately available?
The provided data does not identify a vendor fix or workaround. As an interim exposure-reduction measure, restrict remote access to the flow-run endpoint and limit the application's outbound network access to only required destinations.