CVE-2026-126997

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.7

Description An issue exists in the flow-run component within the file org/jeecg/modules/airag/flow/c/a.class that allows for server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. This is caused by the RestTemplate.exchange() function.

Recommendations Update JeecgBoot to a version newer than 3.9.6. As a temporary mitigation, restrict access to the flow-run component or the RestTemplate.exchange() function.