CVE-2026-19000: JeecgBoot SSRF Vulnerability

CVE-2026-19000 Overview

CVE-2026-19000 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting JeecgBoot versions up to 3.9.2. The flaw resides in the /airag/chat/send endpoint of the Anonymous Chat Attachment Parser component. Attackers can manipulate an unknown parameter to force the server to issue arbitrary outbound HTTP requests. The vulnerability is exploitable remotely without authentication or user interaction. Public exploit details are available, and the JeecgBoot maintainers have stated that a fix is planned for an upcoming release.

Critical Impact
Unauthenticated remote attackers can coerce vulnerable JeecgBoot servers into sending arbitrary requests, enabling internal network reconnaissance and interaction with services otherwise unreachable from the internet.

Affected Products

JeecgBoot versions up to and including 3.9.2
Anonymous Chat Attachment Parser component
Deployments exposing the /airag/chat/send endpoint

Discovery Timeline

2026-08-06 - CVE-2026-19000 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-19000

Vulnerability Analysis

JeecgBoot is a low-code development platform commonly used to build internal enterprise applications. The vulnerable component is the Anonymous Chat Attachment Parser reachable through /airag/chat/send. The endpoint accepts attachment references and fetches remote content on the server side. Because the endpoint does not require authentication and does not validate the destination of outbound requests, an attacker can supply a URL of their choice. The server then issues the request from its own network position, returning or reflecting information about internal services.

SSRF vulnerabilities in AI-adjacent parsing endpoints are particularly useful to attackers. They allow interaction with cloud metadata services, internal admin panels, and other unauthenticated internal APIs. The CWE-918 classification confirms this is a classic server-side request forgery pattern.

Root Cause

The root cause is missing validation of user-supplied URLs before the server issues the outbound fetch. The Anonymous Chat Attachment Parser processes attachment locations without applying an allowlist of hosts, without blocking private and loopback ranges, and without requiring authentication on the /airag/chat/send route. Any input controlling the fetch destination is trusted verbatim.

Attack Vector

An attacker sends a crafted HTTP request to /airag/chat/send referencing an attacker-controlled or internal URL. The JeecgBoot server dispatches the request from its own context. The attacker can target internal IP ranges such as 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, as well as cloud metadata endpoints like 169.254.169.254. The technique enables port scanning, service fingerprinting, and interaction with internal APIs that assume request-origin trust.

See the JeecgBoot GitHub Issue #9672 and the VulDB entry for CVE-2026-19000 for additional technical details.

Detection Methods for CVE-2026-19000

Indicators of Compromise

Requests to /airag/chat/send from unauthenticated sources or unusual client IPs
Outbound HTTP connections from the JeecgBoot host to internal RFC1918 ranges shortly after inbound requests to /airag/chat/send
Connections from the JeecgBoot host to cloud metadata endpoints such as 169.254.169.254
Anomalous DNS lookups originating from the application server matching attacker-controlled domains

Detection Strategies

Inspect web server and reverse proxy logs for POST requests to /airag/chat/send containing URL-like parameters targeting internal hosts, loopback, or metadata IPs
Correlate inbound requests to /airag/chat/send with subsequent outbound connections from the application server using flow logs or EDR network telemetry
Deploy WAF rules that flag SSRF payload patterns including file://, gopher://, dict://, and private-range IP literals within request bodies
Alert on any authentication-free access to AI-related JeecgBoot routes

Monitoring Recommendations

Enable egress logging on the JeecgBoot host and baseline expected destinations
Monitor cloud instance metadata service (IMDS) access, and enforce IMDSv2 on AWS to require session tokens
Track HTTP status codes and response sizes for /airag/chat/send to identify probing behavior

How to Mitigate CVE-2026-19000

Immediate Actions Required

Block or restrict external access to the /airag/chat/send endpoint at the reverse proxy or WAF layer
Require authentication for all JeecgBoot AI chat routes, disabling anonymous access to the attachment parser
Restrict outbound network access from the JeecgBoot server to only necessary destinations using host-based or network firewalls
Enforce IMDSv2 on cloud instances to reduce metadata service exposure

Patch Information

As of the CVE publication date, no patched version has been released. The JeecgBoot maintainers have stated in GitHub Issue #9672 that a fix is planned for an upcoming release. Track the JeecgBoot GitHub repository for the fix release and upgrade immediately when available.

Workarounds

Place JeecgBoot behind a reverse proxy that blocks unauthenticated access to /airag/chat/send
Implement an egress allowlist that denies traffic to RFC1918 ranges, loopback, link-local 169.254.0.0/16, and other sensitive internal destinations from the application server
Deploy a WAF rule that rejects request bodies containing IP literals in private ranges or non-HTTP URI schemes
Isolate the JeecgBoot instance in a network segment without direct access to internal management interfaces or cloud metadata

bash

# Example nginx configuration to block anonymous access to the vulnerable endpoint
location = /airag/chat/send {
    # Require authenticated session cookie or auth header
    if ($http_authorization = "") {
        return 401;
    }
    # Restrict source IPs to trusted internal ranges
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://jeecgboot_backend;
}