{"id":"CVE-2026-103405","kind":"vulnerability","aliases":["CVE-2026-103405"],"related":[],"title":"Juniper Session Smart Router: web server lets attackers inject arbitrary HTTP headers","description":"An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters.","summary":"The web server in Juniper Networks Session Smart Router and Session Smart Conductor does not sanitize certain request body parameters before using them in responses. An attacker can inject arbitrary HTTP headers through those parameters.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","juniper","network-appliance","session-smart-conductor","session-smart-router"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T17:17:25+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:34:36+00:00","updated_at":"2026-10-28T17:34:36+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-28T17:34:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Juniper Session Smart Router: web server lets attackers inject arbitrary HTTP headers","impact":"medium","summary":"The web server in Juniper Networks Session Smart Router and Session Smart Conductor does not sanitize certain request body parameters before using them in responses. An attacker can inject arbitrary HTTP headers through those parameters.","category":"infrastructure","nicknames":[],"who_cares":["juniper","session-smart-router","session-smart-conductor","network-appliance"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker injects arbitrary HTTP headers into responses from the router web server","analyst_note":"Find Juniper's advisory (JSA) for affected Session Smart Router and Conductor versions, fixed releases, and whether the request body parameters are reachable without authentication.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Juniper Networks Session Smart Router or Session Smart Conductor appliances with the web server reachable from their network. The sources do not name affected versions or say which request paths are exposed, so unknown whether a given deployment is in scope.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000567,"input_tokens":3320,"output_tokens":469,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103405':15A,18A '-2026':14A,17A 'allow':96C 'applianc':23B 'arbitrari':10A,61B,101C 'attack':8A,58B,98C 'bodi':50B,107C 'certain':48B 'compon':79C 'conductor':27B,44B,95C 'cve':13A,16A 'downstream':78C 'element':72C 'header':12A,63B,103C 'http':11A,62B,102C 'improp':68C 'infrastructur':19B 'inject':9A,60B,80C,100C 'junip':1A,20B,36B,87C 'let':7A 'network':22B,37B,88C 'network-appli':21B 'neutral':69C 'output':74C 'paramet':51B,66B,108C 'request':49B,106C 'respons':56B 'router':4A,31B,40B,91C 'sanit':47B 'server':6A,34B,85C 'session':2A,25B,29B,38B,42B,89C,93C 'session-smart-conductor':24B 'session-smart-rout':28B 'smart':3A,26B,30B,39B,43B,90C,94C 'special':71C 'unsanit':105C 'use':53B,75C 'via':104C 'vulner':81C 'web':5A,33B,84C","nicknames":[],"mitigations":[],"who_affected":"Teams running Juniper Networks Session Smart Router or Session Smart Conductor appliances with the web server reachable from their network. The sources do not name affected versions or say which request paths are exposed, so unknown whether a given deployment is in scope.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","cvss_by":"sirt@juniper.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103405","severity":null,"published_at":"2026-10-28T17:17:25+00:00","modified_at":"2026-10-28T17:17:25+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}