Executive brief
Arista EOS network switches can be misconfigured so that gNMI access control policies (gNSI Pathz) fail to properly enforce restrictions when both group-level and user-level rules exist for the same path. An authenticated user can exploit this to read or write network configuration paths that should be restricted, potentially allowing unauthorized access to sensitive management interfaces and device configuration.
Technical details
The vulnerability is a privilege escalation flaw (CWE-842: Placement of User into Incorrect Group) in the gNMI server's enforcement of gNSI Pathz authorization policies. When both a group rule and a user rule specify overlapping permissions for the same YANG path, the policy engine fails to correctly apply the most restrictive rule, allowing an authenticated user to bypass intended access controls. The attack requires (1) OpenConfig and gNMI transport to be enabled, (2) gNSI Pathz service to be active, (3) a policy with conflicting group and user rules present, and (4) valid network authentication. The attacker must have some level of authentication to the gNMI server; the flaw then allows unauthorized read/write access to restricted management paths. Arista has not reported active exploitation and provides patches for affected EOS versions (4.36.0.1F and below, 4.35.5M and below, 4.34.6M and below, and select 4.33.x versions).
Affected products
- Arista EOS 4.36.0.1F and below (4.36.x); 4.35.5M and below (4.35.x); 4.34.6M and below (4.34.x); 4.33.2F through 4.33.8M (4.33.x)
Timeline
- 2026-09-09: disclosed: Arista Security Advisory 0164 initially released
- 2026-09-16: other: CVE-2026-73439 published