Quick answers
- Is CVE-2026-101149 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-101149 being exploited in the wild.
- How severe is CVE-2026-101149?
- Medium severity, with a CVSS score of 4.1, published 6 October 2026.
- Which products and versions are affected?
- Arista Cloudvision Portal 2026.2.0, 2026.1.2 and below (2026.1.x), 2025.3.3 and below (2025.3.x), all releases from 2020.3.0 through 2025.3.3.
- Is there a fix for CVE-2026-101149?
- No fixed version is recorded yet. Restrict AAA settings and Account Management configuration permissions to trusted personnel only via Settings → Roles, ensuring only administrative roles have read and write access. Alternatively, switch to a non-OIDC SSO authentication method if feasible.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-06"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-101149 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-101149?
- Check whether you run Arista Cloudvision Portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Restrict AAA settings and Account Management configuration permissions to trusted personnel only via Settings → Roles, ensuring only administrative roles have read and write access. Alternatively, switch to a non-OIDC SSO authentication method if feasible.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-06"}]
Technical details
An insufficiently validated OIDC SSO provider configuration in CloudVision Portal allows a user with high administrative privileges to perform server-side request forgery (SSRF) against internal or external systems. The vulnerability requires both OIDC SSO to be configured and an attacker with specific administrative permissions; no user interaction is required. Successful exploitation can lead to disclosure of information accessible from the CloudVision Portal server.
Affected products
- Arista CloudVision Portal 2026.2.0, 2026.1.2 and below (2026.1.x), 2025.3.3 and below (2025.3.x), all releases from 2020.3.0 through 2025.3.3