Vulnerability-Lookup

GHSA-9RWJ-HHP6-M2CG

Vulnerability from github – Published: 2026-09-16 12:30 – Updated: 2026-09-16 12:30

Details

This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

Severity

4.2 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

2.3 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-19640"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-16T10:16:50Z",
    "severity": "LOW"
  },
  "details": "On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.",
  "id": "GHSA-9rwj-hhp6-m2cg",
  "modified": "2026-09-16T12:30:30Z",
  "published": "2026-09-16T12:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19640"
    },
    {
      "type": "WEB",
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24726-security-advisory-0170"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-19640 (GCVE-0-2026-19640)

Vulnerability from cvelistv5 – Published: 2026-09-16 09:11 – Updated: 2026-09-16 13:57

Title

Security Advisory 0170

Summary

On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 13:55 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

Arista mitre root

References

1 reference

URL	Tags
https://www.arista.com/en/support/advisories-noti…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Arista Networks	EOS	Affected: 4.36.0F , ≤ 4.36.0.1F (custom) Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.33.0F , ≤ 4.33.8M (custom) Affected: 4.24.0F , < 4.33.0F (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19640",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T13:55:08.082343Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T13:57:56.343Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "710 Series",
            "720D Series",
            "720XP/722XPM Series",
            "750X Series",
            "7010TX Series",
            "7020R/R4 Series",
            "7130 Series running EOS",
            "7170 Series",
            "7050X3/X4 Series",
            "7060X/X2/X4/X5/X6 Series",
            "7260X/X3 Series",
            "7280R/R2/R3/R4 Series",
            "7300X/X3 Series",
            "7320X Series",
            "7358X4 Series",
            "7368X4 Series",
            "7388X5 Series",
            "7500R/R2/R3 Series",
            "7800R3/R4 Series",
            "7700R4 Series",
            "AWE 5000 Series",
            "AWE 7200R Series",
            "CloudEOS",
            "cEOS-lab",
            "vEOS-lab",
            "CloudVision eXchange, virtual or physical appliance"
          ],
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "lessThanOrEqual": "4.36.0.1F",
              "status": "affected",
              "version": "4.36.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.35.5M",
              "status": "affected",
              "version": "4.35.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.34.7M",
              "status": "affected",
              "version": "4.34.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.33.8M",
              "status": "affected",
              "version": "4.33.0F",
              "versionType": "custom"
            },
            {
              "lessThan": "4.33.0F",
              "status": "affected",
              "version": "4.24.0F",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-19640, OpenConfig with authorized requests must be configured:\u003c/p\u003e\u003cpre\u003eswitch#show man api gnmi\nTransport: default\nEnabled: yes\nServer: running on port 6030, in default VRF\nSSL profile: oc\nQoS DSCP: none\nConnection limit: 100\nAuthorization required: yes\nAccounting requests: no\nNotification timestamp: last change time\nListen addresses: ::\nAuthentication username priority: x509-spiffe, metadata, x509-common-name\nConfig-commands AAA accounting: enabled\nConfig-commands AAA authorization: enabled\u003c/pre\u003e"
            }
          ],
          "value": "In order to be vulnerable to CVE-2026-19640, OpenConfig with authorized requests must be configured:\n\n  switch#show man api gnmi\n  Transport: default\n  Enabled: yes\n  Server: running on port 6030, in default VRF\n  SSL profile: oc\n  QoS DSCP: none\n  Connection limit: 100\n  Authorization required: yes\n  Accounting requests: no\n  Notification timestamp: last change time\n  Listen addresses: ::\n  Authentication username priority: x509-spiffe, metadata, x509-common-name\n  Config-commands AAA accounting: enabled\n  Config-commands AAA authorization: enabled"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOn affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.\u003c/p\u003e\u003cp\u003eThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.\u003c/p\u003e"
            }
          ],
          "value": "On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T10:13:38.207Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "name": "Security Advisory 0170",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24726-security-advisory-0170"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-19640 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e"
            }
          ],
          "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-19640 has been fixed in the following releases:\n- 4.36.1F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.8M and later releases in the 4.34.x train\n- 4.33.9M and later releases in the 4.33.x train\n\nNo hotfix is available for this issue."
        }
      ],
      "source": {
        "advisory": "Security Advisory 0170",
        "defects": [
          "BUG 1602635",
          "BUG 1602639"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Security Advisory 0170",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerability can be mitigated by performing both of the following actions.\u003c/p\u003e\u003cp\u003e1. Kill gNMI subscriptions after AAA authorization policy changes. Run the following command to kill gNMI subscriptions to OpenConfig/Octa on port 6030. If a different port than the default of 6030 is being used for OpenConfig/Octa, adjust accordingly to that port:\u003c/p\u003e\u003cpre\u003eswitch#bash ss -tnp dport = 6030 | grep -o \u0027pid=[0-9]*\u0027 | cut -d= -f2 | xargs sudo kill\u003c/pre\u003e\u003cp\u003eNote: the port that OpenConfig/Octa is running the gNMI transport on is available in the output of the \u0026quot;show man api gnmi\u0026quot; CLI command (see above under the \u0026quot;Server:\u0026quot; field).\u003c/p\u003e\u003cp\u003e2. Use username and password based authentication (as opposed to mTLS) for gNMI requests to OpenConfig/Octa. The following command is an example using Arista\u0027s gNMI client:\u003c/p\u003e\u003cpre\u003egnmi -username bob -password myPass123 -addr 127.0.0.1 subscribe /system/state\u003c/pre\u003e\u003cp\u003eFor a transport running mTLS, mTLS can be disabled for this transport by any of the configurations described below:\u003c/p\u003e\u003cp\u003ea. Configure the SSL profile to use TLS instead of mTLS. This can be done by removing the trusted certificates from the SSL profile, using the \u0026quot;no trust certificate \u0026lt;name\u0026gt;\u0026quot; CLI command within the SSL profile.\u003c/p\u003e\u003cp\u003eFor example, if an SSL profile has configuration like:\u003c/p\u003e\u003cpre\u003emanagement security\n   ssl profile XXY\n      certificate x.crt key x.key\n      trust certificate A.crt\n      trust certificate B.crt\u003c/pre\u003e\u003cp\u003eThen this profile can be changed from mTLS to TLS by removing each of the trusted certificates:\u003c/p\u003e\u003cpre\u003eswitch#configure\nswitch(config)#management security\nswitch(config-mgmt-security)#ssl profile XXY\nswitch(config-mgmt-sec-ssl-profile-XXY)#no trust certificate A.crt\nswitch(config-mgmt-sec-ssl-profile-XXY)#no trust certificate B.crt\u003c/pre\u003e\u003cp\u003eb. Configure the OpenConfig/Octa transport to use an insecure server instead of mTLS, by removing the SSL profile config from the \u0026quot;transport grpc \u0026lt;name\u0026gt;\u0026quot; mode:\u003c/p\u003e\u003cpre\u003eswitch#configure\nswitch(config)#management api gnmi\nswitch(config-mgmt-api-gnmi)#transport grpc default\nswitch(config-gnmi-transport-default)#no ssl profile\u003c/pre\u003e"
            }
          ],
          "value": "The vulnerability can be mitigated by performing both of the following actions.\n\n1. Kill gNMI subscriptions after AAA authorization policy changes. Run the following command to kill gNMI subscriptions to OpenConfig/Octa on port 6030. If a different port than the default of 6030 is being used for OpenConfig/Octa, adjust accordingly to that port:\n\n  switch#bash ss -tnp dport = 6030 | grep -o \u0027pid=[0-9]*\u0027 | cut -d= -f2 | xargs sudo kill\n\nNote: the port that OpenConfig/Octa is running the gNMI transport on is available in the output of the \"show man api gnmi\" CLI command (see above under the \"Server:\" field).\n\n2. Use username and password based authentication (as opposed to mTLS) for gNMI requests to OpenConfig/Octa. The following command is an example using Arista\u0027s gNMI client:\n\n  gnmi -username bob -password myPass123 -addr 127.0.0.1 subscribe /system/state\n\nFor a transport running mTLS, mTLS can be disabled for this transport by any of the configurations described below:\n\na. Configure the SSL profile to use TLS instead of mTLS. This can be done by removing the trusted certificates from the SSL profile, using the \"no trust certificate \u003cname\u003e\" CLI command within the SSL profile.\n\nFor example, if an SSL profile has configuration like:\n\n  management security\n     ssl profile XXY\n        certificate x.crt key x.key\n        trust certificate A.crt\n        trust certificate B.crt\n\nThen this profile can be changed from mTLS to TLS by removing each of the trusted certificates:\n\n  switch#configure\n  switch(config)#management security\n  switch(config-mgmt-security)#ssl profile XXY\n  switch(config-mgmt-sec-ssl-profile-XXY)#no trust certificate A.crt\n  switch(config-mgmt-sec-ssl-profile-XXY)#no trust certificate B.crt\n\nb. Configure the OpenConfig/Octa transport to use an insecure server instead of mTLS, by removing the SSL profile config from the \"transport grpc \u003cname\u003e\" mode:\n\n  switch#configure\n  switch(config)#management api gnmi\n  switch(config-mgmt-api-gnmi)#transport grpc default\n  switch(config-gnmi-transport-default)#no ssl profile"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2026-19640",
    "datePublished": "2026-09-16T09:11:32.329Z",
    "dateReserved": "2026-08-12T16:48:12.259Z",
    "dateUpdated": "2026-09-16T13:57:56.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.