Is CVE-2026-126997 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126997 being exploited in the wild.

How severe is CVE-2026-126997?

High severity, with a CVSS score of 7.3, published 12 November 2026.

Is there a fix for CVE-2026-126997?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-126997 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126997?

Check whether you run JeecgBoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126997: JeecgBoot server-side request forgery in flow endpoint

CVE-2026-126997 · Severity: high · CVSS 7.3 · Published 2026-11-12

JeecgBoot is an enterprise application framework used to build business software. An unauthenticated attacker can exploit a server-side request forgery (SSRF) vulnerability in the /airag/flow/run endpoint to make the server fetch resources from internal networks or cloud metadata services, potentially exposing sensitive data such as credentials and tokens. The vulnerability exists in default installations because the affected flow is seeded by official SQL data, not requiring administrator configuration.

Technologies: JeecgBoot. Vendors: Jeecg.

Quick answers

Is CVE-2026-126997 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126997 being exploited in the wild.
How severe is CVE-2026-126997?: High severity, with a CVSS score of 7.3, published 12 November 2026.
Which products and versions are affected?: JeecgBoot 3.8.0 through 3.9.5.
Is there a fix for CVE-2026-126997?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-126997 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126997?: Check whether you run JeecgBoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a network-accessible SSRF in the POST /airag/flow/run endpoint, which lacks authentication (@IgnoreAuth) and accepts user-controlled flow parameters. The RestTemplate.exchange method in the flow HTTP node component constructs URLs using the X_GATEWAY_BASE_PATH header and Host header without proper validation, allowing an attacker to redirect requests to arbitrary hosts. The affected flow (ID 1900029596154232833) is pre-seeded in the database, making exploitation possible immediately after installation.

Affected products

Jeecg JeecgBoot 3.8.0 through 3.9.5

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.