Starting with version 10.1 the OpenSSH client has changed in the following way according to openssh.org/txt/release-10.1 :

Add a warning when the connection negotiates a non-post quantum key agreement algorithm.

This warning has been added due to the risk of "store now, decrypt later" attacks. More details at https://openssh.com/pq.html

This warning may be controlled via a new WarnWeakCrypto ssh_config option, defaulting to on. This option is likely to control additional weak crypto warnings in the future.

This means that if customers use OpenSSH clients version 10.1 or higher, they will see the respective warning when connecting to Juniper devices which do not yet support OpenSSH's PQC algorithms.

Juniper is committed to a post quantum cryptography (PQC) roadmap and future versions of our products will support PQC SSH algorithms.

Users can suppress this warning by setting the "WarnWeakCrypto" option in their SSH client config (e.g. /etc/ssh/ssh_config, ~/.ssh/config) to "no-pq-kex".

For details, consult the OpenSSH ssh_config(5) man page: https://man.openbsd.org/ssh_config#WarnWeakCrypto

2026-03-05: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• www.openssh.org/txt/release-10.1 release-notes