CVE-2026-19640

Summary

On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.

This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

Affected Software

Weaknesses

• CWE-863: CWE-863 Incorrect Authorization

Workarounds

The vulnerability can be mitigated by performing both of the following actions.

1. Kill gNMI subscriptions after AAA authorization policy changes. Run the following command to kill gNMI subscriptions to OpenConfig/Octa on port 6030. If a different port than the default of 6030 is being used for OpenConfig/Octa, adjust accordingly to that port:

switch#bash ss -tnp dport = 6030 | grep -o 'pid=[0-9]*' | cut -d= -f2 | xargs sudo kill

Note: the port that OpenConfig/Octa is running the gNMI transport on is available in the output of the "show man api gnmi" CLI command (see above under the "Server:" field).

2. Use username and password based authentication (as opposed to mTLS) for gNMI requests to OpenConfig/Octa. The following command is an example using Arista's gNMI client:

gnmi -username bob -password myPass123 -addr 127.0.0.1 subscribe /system/state

For a transport running mTLS, mTLS can be disabled for this transport by any of the configurations described below:

a. Configure the SSL profile to use TLS instead of mTLS. This can be done by removing the trusted certificates from the SSL profile, using the "no trust certificate <name>" CLI command within the SSL profile.

For example, if an SSL profile has configuration like:

management security ssl profile XXY certificate x.crt key x.key trust certificate A.crt trust certificate B.crt

Then this profile can be changed from mTLS to TLS by removing each of the trusted certificates:

switch#configure switch(config)#management security switch(config-mgmt-security)#ssl profile XXY switch(config-mgmt-sec-ssl-profile-XXY)#no trust certificate A.crt switch(config-mgmt-sec-ssl-profile-XXY)#no trust certificate B.crt

b. Configure the OpenConfig/Octa transport to use an insecure server instead of mTLS, by removing the SSL profile config from the "transport grpc <name>" mode:

switch#configure switch(config)#management api gnmi switch(config-mgmt-api-gnmi)#transport grpc default switch(config-gnmi-transport-default)#no ssl profile

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://www.arista.com/en/support/advisories-notices/security-advisory/24726-security-advisory-0170

• ←Previous
• Next→