Arista EOS eAPI: unauthenticated arbitrary file read, including switch credentials

CVSS 8.7CVE-2026-121371Firmware, BMC & network fabriccurated

Impact

An unauthenticated remote attacker who can reach the eAPI HTTP service on an affected switch can read arbitrary files from the switch filesystem, including stored credentials. In a GPU cluster, Arista switches often carry the Ethernet/RoCE fabric or the management network. Stolen switch credentials can lead to reconfiguring that fabric, which every tenant's traffic crosses. The record does not say which EOS versions or platforms are affected.

Who can reach it

Anyone with network reach to the switch's eAPI (HTTP/HTTPS) service, usually the management VLAN or anywhere eAPI is exposed. No authentication needed. Only switches with eAPI enabled are affected.

What to do

Upgrade EOS to a fixed release from Arista Security Advisory 0218. Upgrading EOS means reloading each switch, so plan around fabric redundancy. Until then, disable eAPI where it is not used, or limit it with an ACL to trusted management hosts. Rotate any credentials stored on switches that had eAPI reachable from untrusted networks.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-121371 https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.