CVE-2026-17192 Overview
CVE-2026-17192 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in an Arista VeloCloud Orchestrator (VCO) feature. The feature does not sufficiently validate caller-supplied input. Authenticated tenant accounts can issue requests to internal services that are not otherwise reachable from outside. Exploitation requires a minimum role of Enterprise Standard Admin. Arista discovered the issue internally and reports no known malicious use in customer networks.
Critical Impact
An authenticated Enterprise Standard Admin can pivot through VCO to reach internal-only services, expanding the reachable attack surface beyond the tenant boundary.
Affected Products
- Arista VeloCloud Orchestrator (VCO)
- Refer to Arista Security Advisory #0145 for affected versions
- Deployments exposing the impacted VCO feature to tenant administrators
Discovery Timeline
- 2026-07-27 - CVE-2026-17192 published to NVD
- 2026-07-30 - Last updated in NVD database
- Discovered internally by Arista
Technical Details for CVE-2026-17192
Vulnerability Analysis
The vulnerability is a classic Server-Side Request Forgery pattern. A VCO feature accepts a URL or host reference from the caller and issues an outbound request on the server's behalf. Because the feature does not sufficiently validate that input, an authenticated tenant user can steer the request toward internal services.
The request is issued by the orchestrator process itself, which typically sits inside a trusted network segment. Targets can include cloud metadata endpoints, management interfaces, and internal APIs that reject direct tenant traffic. The CVSS vector indicates a network attack path with low complexity, and the impact is scoped primarily to subsequent system confidentiality via SSRF pivoting.
Root Cause
Input validation on caller-supplied destination parameters is insufficient. The feature does not restrict the request to an allow-list of expected endpoints, nor does it enforce protocol, host, or IP address constraints before dispatching the outbound call. This aligns with CWE-918: Server-Side Request Forgery.
Attack Vector
An attacker must first obtain credentials for a tenant account with Enterprise Standard Admin privileges. From that account, the attacker submits crafted input to the vulnerable VCO feature. The orchestrator issues the resulting request from its own network context, returning data or triggering actions on internal services that would otherwise be unreachable.
See the Arista Security Advisory #0145 for exploitation prerequisites and impacted endpoints. No public proof-of-concept is available.
Detection Methods for CVE-2026-17192
Indicators of Compromise
- Outbound HTTP requests from the VCO server process to RFC1918 addresses, loopback, or cloud metadata IPs such as 169.254.169.254
- VCO audit log entries showing Enterprise Standard Admin accounts invoking the affected feature with unusual URL or host parameters
- Unexpected authentication attempts from the VCO host against internal management APIs
Detection Strategies
- Baseline the set of internal destinations the VCO service legitimately contacts and alert on deviations
- Inspect VCO application logs for tenant-supplied URLs referencing internal ranges, alternate schemes, or DNS names that resolve to internal hosts
- Correlate tenant admin activity with outbound network flows from the orchestrator host to identify SSRF pivots
Monitoring Recommendations
- Forward VCO audit and access logs to a central SIEM for retention and correlation
- Monitor Enterprise Standard Admin role assignments and flag new or dormant accounts becoming active
- Alert on any request from the VCO host to cloud instance metadata services
How to Mitigate CVE-2026-17192
Immediate Actions Required
- Apply the fixed VCO release identified in Arista Security Advisory #0145
- Review and reduce the number of accounts holding Enterprise Standard Admin or higher privileges
- Rotate credentials for tenant administrator accounts if compromise is suspected
- Restrict VCO egress at the network layer to only required destinations
Patch Information
Arista has published remediation details in Security Advisory #0145. Consult the advisory for the specific fixed VCO versions applicable to your deployment and follow the vendor upgrade procedure.
Workarounds
- Enforce network egress filtering from the VCO host to block traffic to internal management ranges and cloud metadata endpoints
- Require multi-factor authentication for all tenant administrator logins to raise the bar for account abuse
- Audit and remove unused Enterprise Standard Admin accounts to shrink the pool of potential attackers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
