CVE-2026-2380 in EOS
Summary
by MITRE • 09/16/2026
On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.
Examples of sensitive information include: - Sensitive CLI commands (e.g., "username bob secret myPass") - Sensitive OpenConfig YANG leafs (e.g., "system/aaa/global/tacacs/config/secret-key")
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability affects Arista EOS platforms that have OpenConfig-related services enabled, specifically gNMI, gNSI, RESTCONF, and NETCONF. These protocols are commonly used for network automation, configuration management, and telemetry collection. The core technical flaw lies in the logging mechanisms associated with these services, which inadvertently capture sensitive data contained within request and response payloads. This behavior results in the storage of confidential information on local device storage or its transmission to remote accounting servers that aggregate logs for monitoring purposes. It is important to note that this vulnerability does not impact gRPC-based streaming via the Streaming Telemetry Agent when communicating with CloudVision, indicating a specific scope limited to certain API and configuration management interfaces rather than all telemetry data flows.
The operational impact of this flaw involves the exposure of highly sensitive credentials and configuration details. Specifically, plain-text passwords entered into CLI commands, such as user account creation or modification requests containing secret keys, are logged alongside other administrative actions. Additionally, sensitive OpenConfig YANG leafs, including TACACS+ shared secrets and potentially other authentication-related parameters, are recorded in log files. This constitutes a significant security risk because these logs may be accessible to network administrators with lower privilege levels, stored on servers that might not have strict access controls, or retained for longer periods than necessary. The presence of plaintext credentials in logs violates fundamental principles of secure logging and credential management, potentially allowing unauthorized users to gain elevated privileges by extracting passwords from log files if they achieve read access to the affected systems.
From a classification perspective, this vulnerability aligns with CWE-532, which covers information exposure through log files. The unintentional recording of sensitive data represents a failure in input validation and output encoding specific to logging subsystems. In terms of adversary behavior, this flaw facilitates reconnaissance and credential harvesting phases within the MITRE ATT&CK framework. An attacker who gains access to log storage or monitoring systems could leverage these logs to extract valid credentials for further lateral movement or privilege escalation. Although Arista has stated that there are no known instances of malicious exploitation in customer networks at the time of discovery, the potential for abuse remains high given the nature of the exposed data.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. Administrators should ensure that their EOS software is updated to versions where this logging behavior has been corrected or restricted. Where updates are not immediately feasible, organizations can mitigate risk by disabling unnecessary OpenConfig services if they are not required for network operations. Furthermore, implementing strict access controls on log storage systems ensures that only authorized personnel with a need-to-know can view these logs. It is also critical to review existing logging configurations to ensure that sensitive fields such as passwords and secrets are masked or excluded from log output entirely. Regular audits of log content should be conducted to verify compliance with security policies regarding the handling of credentials, ensuring that no plaintext secrets persist in any accessible storage medium.