Insufficient OIDC SSO Provider Validation in Arista Networks Products
CVE-2026-101149

5.1MEDIUM

Key Information:

Vendor

Arista Networks

Status
Cloudvision Portal
Vendor
CVE Published:
6 October 2026

What is CVE-2026-101149?

A vulnerability exists in Arista Networks' products where insufficient validation of OpenID Connect (OIDC) Single Sign-On (SSO) provider configurations may allow a user with elevated privileges to redirect requests to arbitrary destinations. This could potentially exploit the trust relationships established through SSO, leading to unauthorized access or data exposure.

Affected Version(s)

CloudVision Portal CloudVision Portal, virtual appliance or physical appliance 2026.2.0

CloudVision Portal CloudVision Portal, virtual appliance or physical appliance 2026.1.0 <= 2026.1.2

CloudVision Portal CloudVision Portal, virtual appliance or physical appliance 2025.3.0 <= 2025.3.3

References

https://www.arista.com/en/support/advisories-notices/secu...
vendor-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.