Junos Space: stored cross-site scripting across the management web UI lets one operator run actions as another

Impact

An attacker who can place script into Junos Space input fields gets their JavaScript executed in the browser session of any other user who later views the affected page, including an administrator - so the practical ceiling is whatever the victim can do in Junos Space: push configuration to managed switches and routers, run CLI configlets, change device credentials and discovery settings. In a GPU datacenter that manages its Juniper leaf/spine or storage fabric from Junos Space, that is a path from a low-privileged NOC account to fabric-wide configuration change, and fabric changes are felt by every tenant on the affected racks rather than by one node. Juniper split this across 21 CVE ids (CVE-2025-59981 through -59989, -59991 through -60000, -60002, -60009), one per injectable page or field - Device Template Definition, dashboard and global search, Purging Policy, Model Devices, Device Discovery, Device Management, Secure Console, Space Node Settings, Quick Template, Configuration View, CLI Configlets, Archive Log, API Access Profiles and report generation - with the same score, the same advisory and the same fixed release. Scored 5.1 because it needs a victim to visit the page and the confidentiality/integrity impact is scoped to the Junos Space application.

Who can reach it

Reachable by anyone who can submit input to the Junos Space web UI or its API - in practice an authenticated user on the management VLAN, including accounts with far less privilege than the administrator whose session the script ends up running in. Exploitation requires another user to subsequently view the poisoned page (UI:A in the vector). Junos Space should not be exposed outside the management network; if it is, the exposure is correspondingly wider.

What to do

Upgrade Junos Space to 24.1R4 or later; all earlier versions are affected and Juniper's advisory JSA103140 lists no per-page workaround. This is an appliance/application upgrade of the management server - it takes the Junos Space cluster out of service for the maintenance window but does not touch the managed switches, so no fabric reboot or GPU node drain is involved. Until the upgrade lands, restrict Junos Space to the management VLAN, review which accounts can write to device templates, configlets and node settings, and avoid administrators browsing pages populated by untrusted operator input.

Also covers 20 CVEs

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

References

Related entries

• Zabbix frontend: host search filters on hidden fields, turning stored IPMI and PSK secrets into a guessing oracleCVE-2026-59785 · Zabbix frontend (host search filter over non-displayed fields)Medium
• Keycloak: OIDC authentication flaw - attacker reusing data from a same-realm request impersonates a userCVE-2023-0264 · KeycloakMedium
• Backstage Kubernetes backend: resource queries return values the plugin is meant to maskCVE-2026-106561 · Backstage @backstage/plugin-kubernetes-backend (resource query masking)Medium
• MySQL Server: InnoDB flaw allowing a high-privileged network attacker to cause a repeatable DoSCVE-2022-21417 · MySQL ServerMedium
• MySQL Server: InnoDB flaw - a high-privileged network attacker can hang or repeatedly crash the serverCVE-2023-22084 · MySQL ServerMedium
• RabbitMQ: HTTP API enforces no request body limitCVE-2023-46118 · RabbitMQMedium