Arista CloudVision CUE: LDAP injection through authentication input against the configured directory

CVSS 6.9CVE-2026-102156Firmware, BMC & network fabriccurated

Impact

CloudVision is the management and telemetry plane for Arista fabrics - the system that holds device inventory, configuration state and change workflows for the switches a GPU cluster runs on. Authentication input is not properly neutralized before it reaches the configured LDAP directory, so an unauthenticated network attacker can, under conditions the advisory describes as high complexity, inject queries against that directory. The record claims confidentiality impact on a downstream system (the directory service) rather than on CloudVision itself, so the realistic outcome is directory enumeration or disclosure, not direct fabric control. Treat it as management-plane exposure: the identity store behind CloudVision is usually the same one guarding the rest of the operations network.

Who can reach it

Network access to the CloudVision CUE authentication interface, no credentials required, with LDAP authentication configured against a directory service. Exploitation conditions are rated high complexity.

What to do

Follow Arista security advisory 0191 for the fixed releases and any supplied hotfix; the record given here does not state a fixed version, so confirm it against the advisory before scheduling. Until then, restrict reachability of the CloudVision authentication endpoint to the management network and review directory-service logs for anomalous queries.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102156 https://www.arista.com/en/support/advisories-notices/security-advisory/24807-security-advisory-0191

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.