CVE-2026-73463

Summary

On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz.

This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Affected Software

VendorProductVersion RangeStatus
Arista NetworksEOS4.36.0F <= 4.36.0.1Faffected
Arista NetworksEOS4.35.0F <= 4.35.5Maffected
Arista NetworksEOS4.34.0F <= 4.34.7Maffected
Arista NetworksEOS4.33.0F <= 4.33.8Maffected
Arista NetworksEOS4.32.0F <= 4.32.11Maffected
Arista NetworksEOS4.31.0F <= 4.31.10Maffected

Weaknesses

  • CWE-362: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Workarounds

Restrict the set of users that can enable gNSI on OpenConfig / Octa transports via the CLI.

Firstly, configure AAA authorization. The following is an example of configuring AAA authorization for all privilege levels using only the local user database:

switch(config)#aaa authorization commands all default local switch(config)#aaa authorization config-commands

Now restrict a sufficient subset of all roles from enabling gNSI services. In the below example, we prohibit just network-operators:

switch(config-mgmt-api-gnsi)#role network-operator switch(config-role-network-operator)#10 deny mode mgmt-api-gnsi command transport gnmi .* 256 permit command .*

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References