Authorization Flaw in Arista EOS Platforms Affects gRPC Users
CVE-2026-73461

9.4CRITICAL

Key Information:

Vendor

Arista Networks

Status
Eos
Vendor
CVE Published:
16 September 2026

What is CVE-2026-73461?

An authorization flaw has been identified in Arista's EOS platforms when using AAA-based gRPC authorization for OpenConfig. Authenticated users may inadvertently execute gRPC requests with an incorrect privilege level, leading to potential misuse of authorization methods. This issue does not affect requests made through non-gRPC protocols like NETCONF, highlighting a specific security concern in the use of gRPC for managing configurations.

Affected Version(s)

EOS 710 Series 4.29.0F < 4.30.0F

EOS 710 Series 4.30.0F < 4.31.0F

EOS 710 Series 4.31.0F < 4.32.0F

References

https://www.arista.com/en/support/advisories-notices/secu...
vendor-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.