CVE-2026-121291: Arista EOS RPKI error report denial of service

CVE-2026-121291 · Severity: high · CVSS 8.2 · Published 2026-11-10

Arista EOS networking equipment relies on RPKI caches to validate the origin of BGP routes, which is critical for preventing route hijacking attacks. A crafted error message from a compromised RPKI cache server can cause the RPKI agent to become stuck and stop processing route updates, preventing legitimate route validation and potentially allowing invalid routes to propagate through the network. An attacker controlling a RPKI cache or the network path to it can trigger this condition without authentication, disrupting network routing security.

Technologies: Arista cEOS-lab, Arista CloudEOS, Arista Eos, Arista vEOS-lab. Vendors: Arista.

Quick answers

Is CVE-2026-121291 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-121291 being exploited in the wild.
How severe is CVE-2026-121291?
High severity, with a CVSS score of 8.2, published 10 November 2026.
Which products and versions are affected?
Arista cEOS-lab affected versions based on underlying EOS; Arista CloudEOS affected versions based on underlying EOS; Arista Eos 4.37.0F, 4.36.2F and below (4.36.x), 4.35.6M and below (4.35.x); Arista vEOS-lab affected versions based on underlying EOS.
Is there a fix for CVE-2026-121291?
No fixed version is recorded yet. Disable RPKI cache connectivity if RPKI-based BGP origin validation is not required for operations, by removing RPKI cache configuration under BGP. Monitor RPKI error counters and synchronization state using 'show bgp rpki cache' commands to detect affected devices. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-121291 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-121291?
Check whether you run Arista cEOS-lab, Arista CloudEOS, Arista Eos or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable RPKI cache connectivity if RPKI-based BGP origin validation is not required for operations, by removing RPKI cache configuration under BGP. Monitor RPKI error counters and synchronization state using 'show bgp rpki cache' commands to detect affected devices.

Technical details

CVE-2026-121291 involves incorrect behavior order (CWE-696) in EOS's RPKI-to-Router (RPKI-RTR) agent, where a crafted Error Report message can leave the agent stuck believing a cache reset is in progress. The vulnerability requires RPKI cache connectivity to be configured and an RPKI-RTR session established. This causes the agent to stop publishing ROA updates and withdrawals to BGP origin validation, effectively denying route validation service; the agent continues running but cannot process new RPKI data. A fix is available in specific EOS releases.

Affected products

  • Arista EOS 4.37.0F, 4.36.2F and below (4.36.x), 4.35.6M and below (4.35.x)
  • Arista CloudEOS affected versions based on underlying EOS
  • Arista cEOS-lab affected versions based on underlying EOS
  • Arista vEOS-lab affected versions based on underlying EOS

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.