CVE-2026-19640: Arista EOS gNMI Authorization Bypass Vulnerability

CVE-2026-19640 Overview

CVE-2026-19640 is an incorrect authorization vulnerability affecting Arista EOS platforms that expose the gRPC Network Management Interface (gNMI). An authenticated user with gNMI access may receive incorrect authorization results, granting access beyond their assigned permissions. The flaw maps to [CWE-863: Incorrect Authorization]. Arista discovered the issue internally and states no malicious exploitation has been observed in customer networks.

Critical Impact
Authenticated gNMI users may perform operations exceeding their assigned role-based permissions, undermining least-privilege controls on network management traffic.

Affected Products

Arista EOS platforms with gNMI enabled (refer to Arista Security Advisory #0170 for specific affected releases)
Devices exposing the gRPC Network Management Interface to authenticated users
Environments relying on gNMI role-based authorization for privilege separation

Discovery Timeline

2026-09-16 - CVE-2026-19640 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-19640

Vulnerability Analysis

The vulnerability resides in the authorization logic path that processes gNMI requests on Arista EOS. When an authenticated user issues gNMI operations, the system may return authorization decisions that do not align with the user's assigned role or permission set. This allows the user to perform actions beyond the boundaries defined by administrators.

Because gNMI is a streaming telemetry and configuration protocol built on gRPC, incorrect authorization can affect both Get, Set, and Subscribe operations. The result is a potential exposure of configuration data or the ability to modify state that should be restricted. Arista classified the issue under [CWE-863], indicating the access control decision is made but produces an incorrect outcome.

Root Cause

The root cause is an authorization logic defect in how gNMI evaluates a user's effective permissions. Rather than a missing authorization check, the flaw is in the check itself producing incorrect results. This distinction places the issue in the CWE-863 category rather than CWE-862 (Missing Authorization).

Attack Vector

Exploitation requires network access to the gNMI service and valid, low-privileged credentials. The attack vector is network-based, but the attacker must already hold an authenticated session with limited gNMI permissions. There is no public proof-of-concept, and the CVSS 4.0 base score reflects limited confidentiality and integrity impact with no availability impact.

No verified exploitation code is available. Refer to the Arista Security Advisory #0170 for vendor-provided technical details.

Detection Methods for CVE-2026-19640

Indicators of Compromise

gNMI Get, Set, or Subscribe operations initiated by user accounts that target OIDs or paths outside their documented role scope
Unexpected configuration changes correlated with low-privileged gNMI sessions
Authorization decisions in EOS AAA accounting logs that deviate from configured role definitions

Detection Strategies

Baseline the normal gNMI operations issued by each service account and alert on deviations from that baseline
Correlate gNMI activity in AAA accounting logs against configured role-based access control (RBAC) policies to surface mismatches
Enable command accounting for gNMI-invoked operations and forward events to a centralized SIEM for review

Monitoring Recommendations

Forward EOS syslog, AAA, and gNMI telemetry to a centralized data lake for long-term retention and analysis
Monitor gRPC connection metadata (source IP, username, session duration) for anomalous management-plane activity
Track configuration deltas on network devices and correlate them with the initiating gNMI session identity

How to Mitigate CVE-2026-19640

Immediate Actions Required

Review the Arista Security Advisory #0170 to identify affected EOS releases in your environment
Inventory all EOS devices with gNMI enabled and audit assigned user roles and permissions
Restrict gNMI access to management networks and known automation hosts using ACLs
Rotate credentials for any low-privileged gNMI accounts that may have been misused

Patch Information

Arista has published fixed release information in Security Advisory #0170. Upgrade to the vendor-recommended EOS release that addresses the gNMI authorization logic defect. Confirm the target version against the advisory's fixed-release matrix before deployment.

Workarounds

Disable gNMI on devices where it is not required for automation or telemetry workflows
Restrict the set of users authorized to establish gNMI sessions to administrative accounts only
Apply management-plane access control lists to permit gNMI traffic only from trusted controller and orchestration hosts
Enable AAA command accounting to record and review all gNMI-initiated operations