# CVE-2026-101150: Arista CloudVision Portal OIDC bearer token SSRF

Source: https://junglewise.ai/threats/cve-2026-101150-insufficient-validation-of-oidc-bearer-token-configuration-could  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-101150 · Severity: medium · CVSS 4.1 · Published 2026-10-06

Arista CloudVision Portal is a network management and telemetry platform used to monitor and configure large-scale networks. A vulnerability in its OIDC single sign-on (SSO) configuration allows administrators with high privileges to direct requests to arbitrary destinations, potentially exposing internal network information. The issue only affects deployments with OIDC-based SSO explicitly configured and bearer token login enabled.

Technologies: [Arista Cloudvision Portal](https://junglewise.ai/threats/technologies/cloudvision-portal). Vendors: [Arista](https://junglewise.ai/threats/vendors/arista).

## Quick answers

**Is CVE-2026-101150 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101150 being exploited in the wild.

**How severe is CVE-2026-101150?** Medium severity, with a CVSS score of 4.1, published 6 October 2026.

**Which products and versions are affected?** Arista Cloudvision Portal 2026.2.0, 2026.1.2 and below in the 2026.1.x train, 2025.3.3 and below in the 2025.3.x train, all prior releases back to and including 2023.3.0.

**Is there a fix for CVE-2026-101150?** No fixed version is recorded yet. Disable bearer token login in cluster management settings (General Settings → Cluster Management) if not required. Additionally, restrict AAA settings and account management configuration permissions to trusted administrative personnel only via the Roles settings page. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101150 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-101150?** Check whether you run Arista Cloudvision Portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable bearer token login in cluster management settings (General Settings → Cluster Management) if not required. Additionally, restrict AAA settings and account management configuration permissions to trusted administrative personnel only via the Roles settings page.

## Technical details

This is a server-side request forgery (SSRF) vulnerability (CWE-918) in CloudVision Portal's OIDC bearer token validation logic. The flaw requires an authenticated user with high privileges to configure OIDC and enable bearer token login in cluster management settings. An attacker can then craft requests that traverse internal networks or access restricted resources by exploiting insufficient validation of bearer token configuration.

## Affected products

- Arista CloudVision Portal 2026.2.0, 2026.1.2 and below in the 2026.1.x train, 2025.3.3 and below in the 2025.3.x train, all prior releases back to and including 2023.3.0

## Timeline

- 2026-10-06: disclosed

## References

- [https://www.arista.com/en/support/advisories-notices/security-advisory/24802-security-advisory-0186](https://www.arista.com/en/support/advisories-notices/security-advisory/24802-security-advisory-0186)

## Related threats

- [Arista CloudVision CUE authentication bypass via IP spoofing](https://junglewise.ai/threats/cve-2026-102161-an-unauthenticated-attacker-located-on-an-adjacent-private)
- [Arista CloudVision CUE OS command injection in backup management](https://junglewise.ai/threats/cve-2026-102160-an-operating-system-os-command-injection-vulnerability-in)
- [Arista CloudVision-CUE access control bypass in backend](https://junglewise.ai/threats/cve-2026-102159-an-access-control-flaw-in-the-cv-cue-backend-may-allow-an)
- [Arista CloudVision CUE SQL injection in API parameter validation](https://junglewise.ai/threats/cve-2026-102158-improper-validation-of-selected-cloudvision-cue-application)
- [Arista CloudVision CUE IDOR in file-serving interface](https://junglewise.ai/threats/cve-2026-102157-an-insecure-direct-object-reference-idor-vulnerability-in-a)