EUVD-2026-96610
GHSA-p9cq-jf42-732x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitEnumerate record IDs via /airag/app/queryById
-
ExecutionCall queryById on MCP config (authz check commented out)
-
ImpactExfiltrate MCP URLs, headers, and outbound tokens
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated JeecgBoot session of any privilege level (PR:L) - it is not reachable by anonymous/unauthenticated attackers. The deployment must have the AiRAG/MCP module in use with configured MCP server records (endpoint URLs, headers, outbound tokens) stored; a plain JeecgBoot install not using the airag MCP feature exposes nothing sensitive. The specific preconditions are: (1) the /airag/app/queryById endpoint being reachable to enumerate record IDs, and (2) the AiragMcpController queryById permission/authorization check remaining commented out (present in versions through 3.9.5). The main limiting factor is the authentication requirement; no user interaction, no non-default toggle beyond actually using the AIRAG MCP feature, and no special platform are needed. |
| Impact | This is a credible, moderate-priority information-disclosure issue rather than a critical remote-takeover bug. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is internally consistent with the description: network-reachable, low attack complexity, and crucially PR:L - exploitation requires an already-authenticated (even low-privilege) account, so this is a privilege-escalation-of-access / broken-access-control problem, not an unauthenticated breach. Impact is confined to confidentiality (VC:H; integrity and availability N), which matches the leak of MCP endpoint URLs, headers, and outbound authentication tokens. POC exploit code is publicly available and the issue was reported by a credible source (VulnCheck), which raises real-world likelihood, but there is no CISA KEV listing and no EPSS or SSVC data was supplied, so exploitation status is 'publicly available exploit code exists' - do NOT treat this as active in-the-wild exploitation. The real elevated risk here is secondary: leaked outbound auth tokens could enable lateral movement to the MCP-connected backend services, so the effective blast radius may exceed the C:H-only CVSS rating. Missing signals to note: no EPSS score, no KEV status, and no SSVC automatability/technical-impact decision data were provided. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user enumerates record IDs via the unguarded /airag/app/queryById endpoint, then requests the corresponding MCP server configuration records whose authorization check is commented out. Because a public POC (poc_airag_mcp_model_and_writer.py) exists, the attacker scripts the ID harvesting and config retrieval to bulk-exfiltrate MCP endpoint URLs, request headers, and outbound authentication tokens, which can then be reused against the connected MCP/backend services. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded /airag/app/queryById endpoint and then read MCP (Model Context Protocol) server configurations - including endpoint URLs, HTTP headers and outbound authentication tokens - because the permission check in AiragMcpController.queryById is commented out. Exploitation requires a valid JeecgBoot session at any privilege level (CVSS v4.0 PR:L, assessed CVSS 3.1 PR:L) and a deployment that actually uses the AiRAG/MCP feature with stored MCP records; a stock install without configured MCP servers exposes nothing sensitive. Publicly available exploit code exists, though the issue is a moderate-priority information-disclosure flaw (high confidentiality impact, no integrity or availability impact) rather than a remote-takeover bug, and no CISA KEV entry indicates confirmed active exploitation.
RemediationAI
No vendor-released patch identified at time of analysis for CVE-2026-108671, so remediation is limited to mitigating controls until an upstream fix ships. The most direct fix is to restore the commented-out authorization check in AiragMcpController.queryById (and audit /airag/app/queryById for the same defect) so that the record's owning tenant or an administrative role is required - redeploying a locally patched build is the only way to fully close the data path, and this carries the usual fork-maintenance burden. Until then, restrict network access to the /airag/** endpoints to trusted administrative networks or IP allowlists via the reverse proxy or Spring Security filter chain, accepting that legitimate low-privilege AI/RAG users will lose access; disable or undeploy the jeecg-boot-module-airag MCP feature on instances that do not need it, which removes the exposure entirely but disables AI/RAG functionality. Because the flaw discloses outbound authentication tokens, treat all MCP server credentials stored in JeecgBoot as potentially compromised and rotate the corresponding tokens and headers on the downstream MCP servers; also review access logs for requests to /airag/app/queryById and AiragMcpController queryById from unexpected accounts. Reference advisories: https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-airagmcp-querybyid and the proof-of-concept at https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_mcp_model_and_writer.py.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot-based low-code development platform whose optional airag module provides AI/RAG capabilities, including an MCP (Model Context Protocol) client configuration layer. CVE-2026-108671 is a CWE-862 Missing Authorization defect in org.jeecg.modules.airag.llm.controller.AiragMcpController: the queryById handler (around lines 164-173 of the referenced source) performs no permission verification because the authorization check is commented out in the shipped code. MCP server records are stored as entities containing a record id plus the remote MCP endpoint URL, any required HTTP headers and outbound authentication tokens used to authenticate JeecgBoot to third-party MCP servers. Because a sibling endpoint, /airag/app/queryById, is also unguarded, an authenticated user can harvest valid record ids and use them against the MCP controller to exfiltrate those secrets in a read-only fashion (VC:H, VI:N, VA:N). The CPE entry cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* reflects that the affected-line wildcard covers all builds up to and including 3.9.5; the root cause is an authorization decision that is left to client-side or absent checks rather than enforced server-side for every request.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint, low complexity, but any valid account is required so PR:L; only confidentiality is affected (leaked tokens/configs), so I:N/A:N and scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP endpoint URLs, headers, and outbound authentication tokens.
Technical POC Analysis
Note on evidence: the only artifact supplied is a PoC script (pocairagmcpmodelandwriter.py).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
JeecgBoot deployments up to version 3.9.5 that use the AiRAG/MCP feature with stored MCP server configurations are exposed to a high-severity information disclosure flaw. An authenticated user with any privilege level can exploit publicly available exploit code to read sensitive MCP server endpoint URLs, HTTP headers, and outbound authentication tokens due to a missing authorization check. Leadership should care because exposed integration credentials could enable unauthorized access to downstream systems and lateral movement, though stock installations without configured MCP servers are not affected.
No vendor-released patch identified at time of analysis. Interim mitigations include: disable the AiRAG/MCP feature if not operationally required; block or restrict access to the /airag/app/queryById endpoint to trusted administrators only; rotate all MCP outbound authentication tokens and review MCP server configurations for unauthorized changes; implement WAF or reverse proxy rules to detect and block record ID enumeration; and monitor logs for suspicious access to the vulnerable endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Tenant ownership takeover in JeecgBoot through 3.9.5 lets any authenticated user - regardless of privilege level - reass
Exploit-DB