---
id: "CVE-2026-103407"
kind: "vulnerability"
aliases: ["CVE-2026-103407"]
title: "Juniper Session Smart Router: REST user can read or delete arbitrary host files"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "juniper", "network-appliance", "rest-api", "session-smart-conductor", "session-smart-router"]
not_affected_if: ["auth-required", "no-rest-users"]
published_at: "2026-10-28T17:17:26+00:00"
first_seen_at: "2026-10-28T17:34:08+00:00"
updated_at: "2026-10-28T17:36:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103407", "first_seen_at": "2026-10-28T17:34:08+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T17:36:13+00:00"}]
---

# Juniper Session Smart Router: REST user can read or delete arbitrary host files

In Juniper Session Smart Router and Session Smart Conductor, ConfigDirector has a path traversal flaw in its certificate and private-key REST API. An authenticated REST user can read, overwrite, or delete arbitrary certificate and key files on the host filesystem.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

unknown: Juniper advisory for this CVE not read. Check your SSR/Conductor version (show system version) and list accounts with REST/API access on the Conductor.

## Fix

unknown for this CVE. JSA112528 patch notification (unconfirmed link) mentions SSR 7.0.5, 7.1.7, 7.2.3; confirm against the Juniper advisory before upgrading.

## Timeline

- 2026-10-28T17:34:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103407
- 2026-10-28T17:36:13+00:00 analyst — Could not find the Juniper advisory naming CVE-2026-103407; Juniper portal pages render blank. Related JSA112528 (2026-10-16 SSR/Conductor patch notification, via CERT-FR) lists SSR <7.0.5, 7.1.x <7.1.7, 7.2.x <7.2.3, but no source ties it to this CVE (published 12 days later). Versions left unset; nothing verified. REST-on-by-default unconfirmed. Settle by reading the Juniper SIRT advisory for this CVE or the NVD references.

## Documents

- [mentions] CERT-FR AVI-1337: Juniper SSR (cites JSA112528, 16 Oct 2026; no CVE ids) https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1337/
- [mentions] On Demand: Session Smart Router (SSR) and Conductor patch release notification (HPE/Juniper, 2026-10-16) https://supportportal.juniper.net/s/article/On-Demand-Session-Smart-Router-SSR-and-Conductor-patch-release-notification

## From the sources

An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_