Arista EOS (TerminAttr / OpenConfig telemetry transport): TENANT ISOLATION: the streaming-telemetry agent can leak

Impact

TENANT ISOLATION: the streaming-telemetry agent can leak MACsec keys over the telemetry transport. Whoever consumes your telemetry stream — often a monitoring platform with far weaker access control than the switches themselves — ends up holding the keys that protect inter-site and inter-pod links. From there an attacker decrypts traffic for every tenant crossing those links.

Who can reach it

An attacker with access to the telemetry stream or to the collector storing it. That is usually a much softer target than the switch.

What to do

EOS/TerminAttr upgrade plus agent restart. Then rotate every MACsec key that could have been exposed — a fabric-wide key rotation is disruptive and is the real cost here, not the upgrade. Treat telemetry collectors as secret-bearing systems going forward.

References