Tools AI Risk Radar ai-incident-0193
Incident record
JeecgBoot exposes MCP connection secrets to authenticated users
- Severity
- Medium
- Status
- Research
- Type
- Infra Vuln
- Target
- JeecgBoot through 3.9.5
- Actor
- researcher
- CVE
- CVE-2026-108671
What happened
An authenticated user can read MCP connection settings belonging to other users, including server addresses, request headers and stored outbound tokens.
The 10 October CNA record describes missing authorisation in the configuration lookup. The attacker needs relevant record identifiers, which the report obtains from an unprotected AI application path. The CNA gives CVSS 3.1 score 6.5. Its CVSS 4.0 score is 7.1; this row uses the CVSS 3.1 severity. Patch status remains unconfirmed as of 11 October.
Sources
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-108671
- Researcher disclosuregithub.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026