CVE-2026-73457 in EOS
Summary
by MITRE • 09/17/2026
Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticated users.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability described involves a critical information disclosure flaw within the Arista Extensible Operating System when the gRPC Network Packet Sampling Interface is active. This interface allows for high-performance packet sampling and analysis, which is essential for network monitoring and security telemetry. However, under specific operational conditions, the system fails to properly sanitize sensitive authentication data before writing it to accounting logs. Specifically, client credentials used to authenticate with the gNPSI service are written in plaintext rather than being hashed or masked. This logging occurs both locally on the device storage and remotely if centralized log aggregation is configured, making the exposure potentially widespread across an organization's infrastructure.
From a technical perspective, this flaw represents a failure in secure data handling practices where sensitive authentication material is treated as standard operational metadata. The gRPC framework relies heavily on credentials such as TLS certificates or token-based authenticators to establish trust between clients and servers. When these values are persisted in log files without obfuscation, they become accessible to any user account that possesses read permissions for those specific log directories or remote logging endpoints. This is particularly dangerous because accounting logs often have broader access scopes than configuration files, potentially exposing secrets to lower-privileged users who should not have visibility into authentication mechanisms.
The operational impact of this vulnerability is severe, as it directly compromises the confidentiality and integrity of network security controls. Attackers with local or remote read access to these logs can extract valid client credentials, effectively bypassing authentication requirements for the gNPSI service. This allows unauthorized entities to establish packet sampling sessions, potentially leading to further reconnaissance activities where an attacker could monitor traffic patterns, identify sensitive data flows, or map network topology without detection. Furthermore, if these credentials are reused across other systems or services within the enterprise environment, the compromise extends beyond Arista devices, facilitating lateral movement and deeper penetration into the internal network infrastructure.
This issue aligns with CWE-532, which categorizes information exposure through log files as a significant security risk. It also relates to ATT&CK technique T1078, Valid Accounts, where adversaries leverage legitimate credentials obtained from system logs to maintain persistent access and evade detection mechanisms that rely on anomaly-based monitoring of authentication failures. The presence of plaintext secrets in accessible logs creates a high-value target for insider threats or external attackers who have gained initial foothold through other vectors such as phishing or unpatched web services.
Mitigation strategies must focus on immediate remediation of the logging configuration and broader credential hygiene practices. Administrators should immediately restrict access to all accounting log files, ensuring that only highly privileged service accounts can read them, thereby limiting exposure even if the logs contain sensitive data. It is imperative to rotate any credentials associated with gNPSI clients across all affected platforms to invalidate potentially compromised secrets. Additionally, Arista EOS updates or patches addressing this specific logging behavior should be applied as soon as they become available. Long-term mitigation involves implementing strict log sanitization policies that automatically mask or hash sensitive fields before persistence and conducting regular audits of log access permissions to ensure adherence to the principle of least privilege across all network management interfaces.