CVE-2026-57054: Junos OS: MX Series: Web filtering doesn't block specifically formatted URLs
A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable.
If an MX Series device is configured with web filtering, and an attacker sends a request with a specifically formatted URL, this request will get forwarded despite the system being configured to block it. In turn, an attacker can access downstream resources that are expected to be unreachable.
This issue affects Junos OS on MX Series:
all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S8, 24.2 versions before 24.2R2-S5, 24.4 versions before 24.4R2-S4, 25.2 versions before 25.2R2-S1, 25.4 versions before 25.4R1-S2, 25.4R2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Junos OS (MX Series) - URL filtering pluginto a version that resolves this vulnerability.Fixed in 23.2R2-S7 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series) - URL filtering pluginto a version that resolves this vulnerability.Fixed in 23.4R2-S8 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series) - URL filtering pluginto a version that resolves this vulnerability.Fixed in 24.2R2-S5 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series) - URL filtering pluginto a version that resolves this vulnerability.Fixed in 24.4R2-S4 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series) - URL filtering pluginto a version that resolves this vulnerability.Fixed in 25.2R2-S1 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series) - URL filtering pluginto a version that resolves this vulnerability.Fixed in 25.4R1-S2 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series) - URL filtering pluginto a version that resolves this vulnerability.Fixed in 25.4R2 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series) - URL filtering pluginto a version that resolves this vulnerability.Fixed in 26.2R1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57054?
The severity of CVE-2026-57054 is rated as medium with a score of 5.8.
How do I fix CVE-2026-57054?
To fix CVE-2026-57054, ensure the URL filtering plugin is updated to the latest version as per Juniper's security advisory.
What impact does CVE-2026-57054 have on my network?
CVE-2026-57054 allows unauthenticated attackers to bypass web filtering, potentially leading to unauthorized access to restricted resources.
Is CVE-2026-57054 present in all Junos OS versions?
CVE-2026-57054 affects specific implementations of Junos OS on MX Series devices; check your version to confirm.
Can CVE-2026-57054 be exploited remotely?
Yes, CVE-2026-57054 can be exploited by unauthenticated, network-based attackers.