Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-108671: JeecgBoot lets logged‑in users view server settings

CVE-2026-108671 · published 25 days ago

Summary

In JeecgBoot versions up to 3.9.5, a check that should stop users from reading MCP server configuration is missing. This means anyone who can log into the system can see internal endpoint URLs, request details, and authentication tokens. Apply the latest updates from the vendor or patch the affected query endpoint to restore proper access controls.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
jeecgboot	jeecgboot	<= 3.9.5

Original advisory text

JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP endpoint URLs, headers, and outbound authentication tokens.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-1086... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-108671 Vendor Advisory
https://github.com/jeecgboot/JeecgBoot Product
https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c8... Third Party Advisory
https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0... Exploit
https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorizati... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published10 Oct 2026

Updated3 Nov 2026

First seen10 Oct 2026

Sources

CVE-2026-108671 · NVD

CVE-2026-108671 · MITRE

CVE-2026-108671 · OSV

Track software like this

Free during beta