Arista EOS: gRPC OpenConfig requests authorized at the wrong privilege level

CVSS 9.4CVE-2026-73461Firmware, BMC & network fabriccurated

Impact

With AAA-based gRPC authorization enabled for OpenConfig, an authenticated user's requests can be evaluated against the wrong AAA method list and the wrong privilege level. The practical result is that read-only or limited operator accounts may be permitted to perform configuration changes the authorization policy was written to deny - on the switches carrying the training fabric and storage network. Operators who rely on AAA tiering to let tooling or junior staff query switch state without changing it lose that separation silently, since the requests succeed rather than erroring. Non-gRPC OpenConfig paths such as NETCONF are not affected.

Who can reach it

Any authenticated user or automation identity that can issue gRPC OpenConfig requests to an affected switch with AAA-based gRPC authorization configured.

What to do

Treat gRPC OpenConfig access as effectively unrestricted until patched, and narrow which identities can reach it. Use NETCONF for OpenConfig access in the interim if that fits your tooling, since it is not affected. Take the fixed EOS release or hotfix from Arista security advisory 0163 and upgrade per switch; the record does not name a fixed version.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-73461 https://www.arista.com/en/support/advisories-notices/security-advisory/24719-security-advisory-0163

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.