CVE-2026-17192

Summary

A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin.

This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

Affected Software

VendorProductVersion RangeStatus
Arista NetworksVeloCloud Orchestrator On-Prem5.2.0 < 5.2.3.14affected
Arista NetworksVeloCloud Orchestrator On-Prem6.1.0 < 6.1.3.4affected
Arista NetworksVeloCloud Orchestrator On-Prem6.4.0 < 6.4.2.4affected

Weaknesses

  • CWE-918: CWE-918 Server-Side Request Forgery (SSRF)

Workarounds

The recommended resolution is to upgrade to a fixed VCO release as soon as it is available. For VCOs which are not on a supported release train, customers can contact TAC to discuss possible upgrade options for your release.

Until the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:

  • Restrict access to the VCO web interface to trusted administrative networks.

  • Monitor the VCO for accesses from known malicious source IPs.

  • Monitor for unexpected outbound network activity from the VCO host.

  • Review recent administrator activity for unexpected changes.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References