Is CVE-2026-126998 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126998 being exploited in the wild.

How severe is CVE-2026-126998?

High severity, with a CVSS score of 7.3, published 12 November 2026.

Is there a fix for CVE-2026-126998?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-126998 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126998?

Check whether you run JeecgBoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126998: JeecgBoot authentication bypass in OpenAPI endpoint

CVE-2026-126998 · Severity: high · CVSS 7.3 · Published 2026-11-12

JeecgBoot is a Java application framework used to build business software. Versions up to 3.9.5 contain an authentication bypass flaw in the /openapi/call endpoint that allows attackers to steal administrator credentials and access sensitive internal data without needing valid credentials. An attacker can exploit this remotely to impersonate administrators and compromise the entire application.

Technologies: JeecgBoot. Vendors: Jeecg.

Quick answers

Is CVE-2026-126998 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126998 being exploited in the wild.
How severe is CVE-2026-126998?: High severity, with a CVSS score of 7.3, published 12 November 2026.
Which products and versions are affected?: JeecgBoot 3.9.2, 3.9.3, 3.9.5.
Is there a fix for CVE-2026-126998?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-126998 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126998?: Check whether you run JeecgBoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability manifests in two variants across JeecgBoot 3.9.x: in 3.9.2/3.9.3, the API signature is computed with a predictable construction (MD5 of appkey + hardcoded seed secret + timestamp) and the request Host/X_GATEWAY_BASE_PATH is used without URL validation to forge signatures and exfiltrate admin JWTs; in 3.9.5/main, the ApiAuthFilter short-circuits authentication for OPTIONS requests while a URL check only permits internal networks, allowing attackers to read internal admin data or capture JWTs via self-proxying. Both variants are network-exploitable without authentication or user interaction.

Affected products

Jeecg JeecgBoot 3.9.2, 3.9.3, 3.9.5

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.