CVE-2026-17191

Summary

An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.

This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

Affected Software

VendorProductVersion RangeStatus
Arista NetworksVeloCloud Orchestrator On-Prem5.2.0 < 5.2.3.14affected
Arista NetworksVeloCloud Orchestrator On-Prem6.1.0 < 6.1.3.4affected
Arista NetworksVeloCloud Orchestrator On-Prem6.4.0 < 6.4.2.4affected

Weaknesses

  • CWE-89: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Workarounds

Until the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:

  • Restrict access to the VCO web interface to trusted administrative networks.

  • Monitor the VCO for accesses from known malicious source IPs.

  • Monitor for unexpected outbound network activity from the VCO host.

  • Review recent administrator activity for unexpected changes.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References