# CVE-2026-17191: Arista VeloCloud Orchestrator SQL injection in flow metrics API

Source: https://junglewise.ai/threats/cve-2026-17191-arista-velocloud-orchestrator-sql-injection-in-flow-metrics-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-17191 · Severity: critical · CVSS 9.1 · Published 2026-07-27

Arista VeloCloud Orchestrator, a platform used to manage SD-WAN networks, contains a security flaw in its flow metrics API. An authenticated user with even low-level access can manipulate database queries to view sensitive information they are not authorized to see. Additionally, this flaw can be used to force the orchestrator to make unauthorized connections to other internal systems, potentially leading to further network compromise.

Technologies: [Arista Networks VeloCloud Orchestrator On-Prem](https://junglewise.ai/threats/technologies/velocloud-orchestrator-on-prem). Vendors: [Arista Networks](https://junglewise.ai/threats/vendors/arista-networks).

## Quick answers

**Is CVE-2026-17191 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17191 being exploited in the wild.

**How severe is CVE-2026-17191?** Critical severity, with a CVSS score of 9.1, published 27 July 2026.

**Which products and versions are affected?** Arista Networks VeloCloud Orchestrator On-Prem 5.2.x prior to 5.2.3.14, 6.1.x prior to 6.1.3.4, 6.4.x prior to 6.4.2.4.

**Is there a fix for CVE-2026-17191?** A patch was published on 2026-07-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17191 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-17191?** Check whether you run Arista Networks VeloCloud Orchestrator On-Prem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An SQL injection vulnerability (CWE-89) exists in the flow metrics API component of Arista VeloCloud Orchestrator (VCO). The flaw is caused by improper neutralization of special elements in user-supplied input, allowing an authenticated attacker to manipulate backend SQL queries. Successful exploitation enables unauthorized data access and Server-Side Request Forgery (SSRF), where the system can be forced to initiate outbound network connections. The attack requires a valid session with at least 'Enterprise Read Only' privileges. The issue is resolved in versions 5.2.3.14, 6.1.3.4, and 6.4.2.4.

## Affected products

- Arista Networks VeloCloud Orchestrator On-Prem 5.2.x prior to 5.2.3.14, 6.1.x prior to 6.1.3.4, 6.4.x prior to 6.4.2.4

## Timeline

- 2026-07-27: advisory
- 2026-07-27: patched

## References

- [https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145](https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145)

## Related threats

- [Arista VeloCloud Orchestrator SSRF due to missing input validation](https://junglewise.ai/threats/cve-2026-17192-arista-velocloud-orchestrator-ssrf-due-to-missing-input)
- [Arista VeloCloud Orchestrator OS command injection in on-prem host](https://junglewise.ai/threats/cve-2026-16812-arista-velocloud-orchestrator-os-command-injection-in-on-prem)