CVE-2026-73445

Summary

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz.

This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

Affected Software

VendorProductVersion RangeStatus
Arista NetworksEOS4.36.0F <= 4.36.0.1Faffected
Arista NetworksEOS4.35.0F <= 4.35.5Maffected
Arista NetworksEOS4.34.0F <= 4.34.7Maffected
Arista NetworksEOS4.33.0F <= 4.33.8Maffected
Arista NetworksEOS4.32.0F < 4.33.0Faffected
Arista NetworksEOS4.31.0F < 4.32.0Faffected

Weaknesses

  • CWE-20: CWE-20 Improper Input Validation

Workarounds

  1. Include exactly one UploadRequest in a gNSI Authz Rotate request.

  2. Use a gNSI Authz policy that restricts gNSI Authz use to only those who strictly need it. Below is an example policy that only allows user "Neo" to rotate Authz policies:

{ "name":"restrict-authz-policy", "allow_rules":[ { "name":"neoallow", "request":{ "paths":[ "/gnsi.authz.v1.Authz/Rotate" ], "headers":[ { "key":"username", "values":[ "Neo" ] } ] } }, { "name":"allow-gnmi", "request":{ "paths":[ "/gnmi.gNMI/" ] } }, { "name":"allow-gnoi", "request":{ "paths":[ "/gnoi." ] } } ] }

Ideally, this policy would be uploaded via a gNSI client for correct version and created-on metadata handling. However, the policy can also be written directly to the active policy file:

switch#bash timeout 100 echo "{&#34;name&#34;:&#34;restrict-authz-policy&#34;,&#34;allow_rules&#34;:[{&#34;name&#34;:&#34;neoallow&#34;,&#34;request&#34;:{&#34;paths&#34;:[&#34;/gnsi.authz.v1.Authz/Rotate&#34;],&#34;headers&#34;:[{&#34;key&#34;:&#34;username&#34;,&#34;values&#34;:[&#34;Neo&#34;]}]}},{&#34;name&#34;:&#34;allow-gnmi&#34;,&#34;request&#34;:{&#34;paths&#34;:[&#34;/gnmi.gNMI/&#34;]}},{&#34;name&#34;:&#34;allow-gnoi&#34;,&#34;request&#34;:{&#34;paths&#34;:[&#34;/gnoi.&#34;]}}]}" | sudo tee /persist/sys/gnsi/authz/policy.json && sleep 11

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References