CVE-2026-126998

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6

Description An issue in the Authentication Filter component allows for remote server-side request forgery (SSRF), a flaw where an attacker can induce the server to make requests to an unintended location. This occurs within the OpenApiController.call function at the '/openapi/call' endpoint.

Recommendations Update JeecgBoot to version 3.9.6 or later. As a temporary workaround, restrict access to the '/openapi/call' endpoint to minimize the risk of exploitation.