Credentials Exposure in Arista EOS with gRPC Network Packet Sampling
CVE-2026-73457

6MEDIUM

Key Information:

Vendor

Arista Networks

Status
Eos
Vendor
CVE Published:
16 September 2026

What is CVE-2026-73457?

In specific conditions on platforms utilizing Arista EOS with the gRPC Network Packet Sampling Interface (gNPSI) activated, the client credentials may be inadvertently logged in clear text format. This logging can occur in both local and remote accounting logs, making them accessible to authenticated users. Such exposure poses a security risk as sensitive credential information may be retrieved and exploited if proper access controls are not enforced.

Affected Version(s)

EOS 710 Series 4.36.0 <= 4.36.1F

EOS 710 Series 4.35.0 <= 4.35.5M

EOS 710 Series 4.34.2F <= 4.34.7M

References

https://www.arista.com/en/support/advisories-notices/secu...
vendor-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered internally by Arista.
.