Junos OS Evolved na-grpcd: unauthenticated gRPC subscription request crashes the telemetry daemon

CVSS 8.7CVE-2026-102012Firmware, BMC & network fabriccurated

Impact

A reachable assertion in na-grpcd lets an unauthenticated remote attacker crash the gRPC daemon with a telemetry subscription request, and the CVSS vector marks it continuously repeatable - so the attacker can hold the daemon down. The device keeps forwarding, but the fleet loses the streaming telemetry it depends on to see fabric congestion and link flaps, and gNMI-driven configuration pushes fail while the daemon is down. The distinguishing feature against the other DoS in this advisory is that this one needs no credentials at all, only reachability to the gRPC port.

Who can reach it

Network: anyone able to reach the device's gRPC/gNMI port. No authentication required.

What to do

Upgrade to the fixed Junos OS Evolved release in JSA112250 (reboot per device). The effective interim control is network-level: the gRPC listener should only be reachable from the telemetry collectors on the management network, never from tenant or internet-facing segments. No fixed version is given in this record.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102012 https://supportportal.juniper.net/JSA112250

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.