Junos Space: crafted GET reads arbitrary files on the network management server

Impact

Junos Space is the management application for Juniper switching and routing, which in a GPU datacenter is the gear carrying tenant, storage and management traffic. An authenticated low-privileged user can walk outside the paths the JBoss daemon is meant to serve and read any file on the appliance filesystem. That filesystem is where device configurations, inventory and management credentials live, so a read-only account on the management console can become knowledge of how the whole fabric is configured and potentially the secrets used to reach it. All versions before 24.1R3 are affected.

Who can reach it

A network-based attacker with a valid Junos Space account, including a low-privileged one (PR:L). Reachable by anyone on the management VLAN who holds credentials; no exploit of the managed devices themselves is involved.

What to do

Upgrade Junos Space to 24.1R3. This is a management appliance upgrade - the maintenance window is on the Junos Space server, which goes offline during the upgrade; managed switches and routers keep forwarding and no GPU node is touched. Until the upgrade, keep Junos Space off any routable path from tenant networks, prune unnecessary low-privileged accounts, and assume anything readable on that appliance may already be known if untrusted accounts existed.

References

Related entries

• SK Hynix DDR5 DIMMs (manufactured 2021-01 through 2024-12): Rowhammer bit flips on DDR5, which had been assumed outCVE-2025-6202 · SK Hynix DDR5 DIMMs (manufactured 2021-01 through 2024-12)High
• Jenkins JDepend Plugin: unconfigured XML parser allows XXE from a build's JDepend reportCVE-2025-64134 · Jenkins JDepend Plugin (bundled JDepend Maven Plugin XML parser)High
• AMD Zen 5 RDSEED (16-bit and 32-bit variants): On Zen 5, the 16-bit and 32-bit forms of RDSEED return zero far moreCVE-2025-68313 · AMD Zen 5 RDSEED (16-bit and 32-bit variants)High
• adm-zip: extracted zip entries keep setuid/setgid bits, planting root setuid binaries in builds run as rootCVE-2026-102282 · adm-zip (Node.js zip extraction, keepOriginalPermission mode)High
• Flyte: FILE-mounted secrets land in pod spec env vars, readable by anyone with pod readCVE-2026-108728 · Flyte secrets webhook (FILE-mounted secrets written to the SECRETS env var)High
• Grafana: Auth Proxy cache key collision authenticates a low-privileged user as an administratorCVE-2026-14199 · Grafana Auth Proxy authentication (identity cache key built by concatenation)High