CVE-2026-73457: Arista EOS gNPSI credential logging in clear text

CVE-2026-73457 · Severity: medium · CVSS 5.3 · Published 2026-09-16

Arista EOS switches with the gRPC Network Packet Sampling Interface (gNPSI) enabled may log client credentials in clear text to local and remote accounting logs, exposing authentication details to anyone with access to those logs. This vulnerability requires specific authentication configuration and explicit trace facility enabling, limiting exposure to environments with particular gNPSI settings enabled.

Technologies: Arista cEOS-lab, Arista CloudEOS, Arista Eos, Arista vEOS-lab. Vendors: Arista.

Quick answers

Is CVE-2026-73457 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73457 being exploited in the wild.
How severe is CVE-2026-73457?
Medium severity, with a CVSS score of 5.3, published 16 September 2026.
Which products and versions are affected?
Arista cEOS-lab affected versions aligned with EOS releases; Arista CloudEOS affected versions aligned with EOS releases; Arista Eos 4.36.1F and below (4.36.x train), 4.35.5M and below (4.35.x train), 4.34.2F through 4.34.7M (4.34.x train); Arista vEOS-lab affected versions aligned with EOS releases.
Is there a fix for CVE-2026-73457?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-73457 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-73457?
Check whether you run Arista cEOS-lab, Arista CloudEOS, Arista Eos or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an improper logging vulnerability (CWE-532) in Arista EOS gNPSI where client credentials are written in clear text to accounting logs under certain configuration circumstances. The vulnerability occurs when gNPSI is explicitly configured with the EosRpcAuth trace facility enabled, allowing authenticated users with access to local or remote accounting logs to view sensitive credentials. Attack vector is network-based and requires prior authentication to the device; exploitation has no user interaction requirement. Affected EOS versions include 4.36.1F and below, 4.35.5M and below, and specific 4.34.x releases. Mitigation involves configuring mutual TLS with only x509-spiffe authentication enabled.

Affected products

  • Arista EOS 4.36.1F and below (4.36.x train), 4.35.5M and below (4.35.x train), 4.34.2F through 4.34.7M (4.34.x train)
  • Arista CloudEOS affected versions aligned with EOS releases
  • Arista cEOS-lab affected versions aligned with EOS releases
  • Arista vEOS-lab affected versions aligned with EOS releases

Timeline

  • 2026-09-09: advisory: Arista Security Advisory 0158 initial release
  • 2026-09-22: other: CSAF JSON file added to advisory
  • 2026-09-16: disclosed: CVE published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.