{"id":"CVE-2026-103406","kind":"vulnerability","aliases":["CVE-2026-103406"],"related":[],"title":"Juniper Session Smart Conductor: crafted salt minion ID runs root commands","description":"An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.","summary":"The AutomatedProvisioner component of Juniper Networks Session Smart Conductor fails to neutralize special characters in a salt minion ID, so OS commands are passed to the shell. A remote attacker who sends a specially crafted minion ID can execute arbitrary commands as root.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","juniper","network-infrastructure","session-smart-conductor"],"not_affected_if":["no-session-smart-conductor"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-28T17:17:25+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:34:14+00:00","updated_at":"2026-10-28T17:34:14+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T17:34:14Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Juniper Session Smart Conductor: crafted salt minion ID runs root commands","impact":"high","summary":"The AutomatedProvisioner component of Juniper Networks Session Smart Conductor fails to neutralize special characters in a salt minion ID, so OS commands are passed to the shell. A remote attacker who sends a specially crafted minion ID can execute arbitrary commands as root.","category":"infrastructure","nicknames":[],"who_cares":["juniper","session-smart-conductor","network-infrastructure"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote commands execute as root on the conductor appliance","analyst_note":"Find Juniper's advisory for affected and fixed versions and whether AutomatedProvisioner is on by default; NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-103406 has no product details.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-session-smart-conductor"],"who_is_affected":"Organizations running Juniper Networks Session Smart Conductor with the AutomatedProvisioner component exposed to salt minion traffic. Sites that do not run Session Smart Conductor or do not use this provisioner can skip it. The sources do not list affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000582,"input_tokens":3311,"output_tokens":502,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-103406':14A,17A '-2026':13A,16A 'allow':91C 'arbitrari':66B,97C 'attack':56B,94C 'automatedprovision':28B,84C 'charact':40B 'command':11A,48B,67B,80C,98C 'compon':29B 'conductor':4A,26B,35B,90C 'craft':5A,61B,104C 'cve':12A,15A 'element':75C 'execut':65B,96C 'fail':36B 'id':8A,45B,63B,107C 'improp':71C 'infrastructur':18B,22B 'junip':1A,19B,31B,86C 'minion':7A,44B,62B,106C 'network':21B,32B,87C 'network-infrastructur':20B 'neutral':38B,72C 'os':47B,79C 'pass':50B 'remot':55B,93C 'root':10A,69B,100C 'run':9A 'salt':6A,43B,105C 'send':58B 'session':2A,24B,33B,88C 'session-smart-conductor':23B 'shell':53B 'smart':3A,25B,34B,89C 'special':39B,60B,74C,103C 'use':76C 'via':101C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Juniper Networks Session Smart Conductor with the AutomatedProvisioner component exposed to salt minion traffic. Sites that do not run Session Smart Conductor or do not use this provisioner can skip it. The sources do not list affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"sirt@juniper.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103406","severity":null,"published_at":"2026-10-28T17:17:25+00:00","modified_at":"2026-10-28T17:17:26+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}