{ "document": { "category": "security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "publisher": { "category": "vendor", "contact_details": "support@arista.com", "name": "Arista PSIRT", "namespace": "https://www.arista.com" }, "references": [ { "category": "self", "summary": "Security advisory 168 canonical URL", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24724-security-advisory-0168" } ], "title": "Security Advisory 168", "tracking": { "current_release_date": "2026-09-17T11:48:17Z", "generator": { "engine": { "name": "Arista Networks SecEng Service CSAF Generator" } }, "id": "Arista Networks Security Advisory 168", "initial_release_date": "2026-09-17T11:48:17Z", "revision_history": [ { "date": "2026-09-17T11:48:17Z", "number": "1", "summary": "Document created" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "EOS version 4.19.0", "product": { "name": "EOS version 4.19.0", "product_id": "CSAFPID-1" } }, { "category": "product_version", "name": "EOS version 4.36.2", "product": { "name": "EOS version 4.36.2", "product_id": "CSAFPID-0" } } ], "category": "product_name", "name": "EOS" } ], "category": "product_family", "name": "Software Products" } ], "category": "vendor", "name": "Arista Networks, Inc." } ] }, "vulnerabilities": [ { "cve": "CVE-2026-2380", "id": { "system_name": "Arista Bug ID", "text": "1207374" }, "notes": [ { "category": "description", "text": "On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.\n\nExamples of sensitive information include:\n\n* Sensitive CLI commands (e.g., \u201cusername bob secret myPass\u201d)\n* Sensitive OpenConfig YANG leafs (e.g., \u201csystem/aaa/global/tacacs/config/secret-key\u201d)", "title": "CVE Description" }, { "category": "other", "text": "To be vulnerable to CVE-2026-2380, any of the following configurations must be present:\n\n1. gNMI server is enabled\n2. RESTCONF server is enabled\n3. NETCONF server is enabled\n\nWith any of these servers enabled, the OpenConfig/Octa agent can log sensitive information in the local log file.\n\n**OpenConfig agent sensitive logging (gNMI, NETCONF, RESTCONF)**\n\n**gNMI**\n\ngNMI server is enabled, and a client sends a request with sensitive configuration.\n\nor\n\n**RESTCONF**\n\nRESTCONF server is enabled, and a client sends a request with sensitive configuration.\n\nor\n\n**NETCONF**\n\nNETCONF server is enabled, and a client sends a request with sensitive configuration.\n\nIn addition to local logging, sensitive information may be recorded on remote accounting servers if any of the following configurations are present:\n\n**gRPC AAA accounting sensitive logging (for gNMI only)**\n\nThe gNMI server is enabled with request accounting, and a client sends a request containing sensitive information.\n\n**gNSI.Acctz accounting sensitive logging (for gNMI only)**\n\nThe gNMI server is enabled with gNSI.Acctz accounting, and a client sends a request with sensitive information.\n\n**OpenConfig agent tracing sensitive logging**\n\nRequests containing sensitive configuration may be logged by default (i.e., without debug tracing enabled). However, enabling debug tracing for the OpenConfig/Octa agent may log additional sensitive information, such as responses and gNSI requests/responses.\n\nOpenConfig agent with debug tracing enabled (at any level):\n\nOcta agent with debug tracing enabled (at any level):", "title": "1207374: Required Config for Exploitation" } ], "product_status": { "first_affected": [ "CSAFPID-1" ], "fixed": [ "CSAFPID-0" ] }, "references": [ { "category": "external", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2380", "summary": "MITRE" } ], "remediations": [ { "category": "vendor_fix", "details": "Fixed in EOS version 4.36.2", "product_ids": [ "CSAFPID-0" ] }, { "category": "none_available", "details": "Not fixed in EOS version 4.19.0", "product_ids": [ "CSAFPID-1" ] }, { "category": "mitigation", "details": "Do not transmit sensitive information in requests that modify configuration using the following operations:\n\n* gNMI Set update or replace\n* RESTCONF PUT, PATCH, or POST\n* NETCONF , , or \n\nThe vulnerability can be mitigated by avoiding the transmission of requests containing sensitive information over gNMI, RESTCONF, or NETCONF. Additionally, debug tracing for the OpenConfig or Octa agents should not be enabled, i.e., do not configure \u201c`trace OpenConfig setting */*`\u201d or \u201c`trace Octa setting */*`\u201d. Provided that no sensitive information is transmitted in a request that modifies configuration, the information that may be exposed through debug tracing is limited to values of sensitive OpenConfig types (e.g., routing-password). ; pPlease note that this can only avoid sensitive information showing in the debug traces, but can not mitigate the issue caused by other configurations mentioned in the Required Configuration for Exploitation section.\n\nShould it be determined that sensitive information has been logged, the affected log files must be truncated and any compromised secrets rotated to prevent unauthorized credential usage.\n\nUse the following commands to clean up OpenConfig and Octa log files:\n\nThen use the following commands to clean up previously rotated old log files:" } ], "scores": [ { "cvss_v3": { "baseScore": 7.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-0", "CSAFPID-1" ] } ], "title": "CVE-2026-2380" } ] }