JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because… (CVE-2026-108671)

CVE-2026-108671 describes a missing authorization vulnerability in JeecgBoot up to version 3.9.5. The vulnerability arises because the queryById permission check is disabled (commented out), allowing any authenticated user to access the /airag/app/queryById endpoint without proper authorization. This endpoint exposes MCP server configuration details such as endpoint URLs, headers, and outbound authentication tokens, which could lead to information disclosure.

The vulnerability allows any authenticated user to read sensitive MCP server configuration data, including endpoint URLs and authentication tokens. This exposure can compromise confidentiality of internal configurations, potentially aiding further attacks or unauthorized access to backend services. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /airag/app/queryById endpoint to only trusted users or roles, and monitor for unauthorized access attempts. Review and re-enable proper permission checks on the queryById endpoint as a priority.