Live › vulnerability › CVE-2026-103406
Go to dashboardThe AutomatedProvisioner component of Juniper Networks Session Smart Conductor fails to neutralize special characters in a salt minion ID, so OS commands are passed to the shell. A remote attacker who sends a specially crafted minion ID can execute arbitrary commands as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Organizations running Juniper Networks Session Smart Conductor with the AutomatedProvisioner component exposed to salt minion traffic. Sites that do not run Session Smart Conductor or do not use this provisioner can skip it. The sources do not list affected versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.
This page as .md · .json · in your agent: get_signal("CVE-2026-103406")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.