CVE-2026-2380: Arista EOS Information Disclosure Vulnerability

CVE-2026-2380 Overview

CVE-2026-2380 affects Arista EOS devices running OpenConfig-related services, including gNMI, gNSI, RESTCONF, and NETCONF. The vulnerability causes sensitive requests and responses to be unintentionally recorded in logs. These entries may be stored on the local EOS device or forwarded to remote accounting servers. Exposed content includes CLI commands containing credentials (for example, username bob secret myPass) and OpenConfig YANG leafs such as system/aaa/global/tacacs/config/secret-key. Arista discovered the issue internally and reports no known malicious exploitation. gRPC-based streaming via the Streaming Telemetry Agent to CloudVision is not affected.

Critical Impact
Credentials, TACACS secret keys, and other sensitive configuration values may be written in cleartext to local logs and remote accounting servers, exposing authentication material to anyone with log access.

Affected Products

Arista EOS devices with gNMI or gNSI services enabled
Arista EOS devices with RESTCONF enabled
Arista EOS devices with NETCONF enabled

Discovery Timeline

2026-09-16 - CVE-2026-2380 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-2380

Vulnerability Analysis

The vulnerability falls under [CWE-256]: Plaintext Storage of a Password. Arista EOS logs sensitive OpenConfig payloads without redaction when management services process configuration operations. Any CLI command or YANG leaf containing secrets can appear verbatim in operational logs. Because EOS forwards accounting events to configured remote servers (TACACS+, RADIUS, or syslog collectors), the exposure extends beyond the switch itself. Log aggregation platforms, SIEMs, and backup systems become secondary repositories of cleartext credentials.

Root Cause

The logging subsystem for OpenConfig-related services does not enforce a redaction policy for fields marked as sensitive in the YANG schema or in CLI parser metadata. Requests transiting gNMI, gNSI, RESTCONF, and NETCONF are serialized to accounting and command history logs before secret fields are filtered. The Streaming Telemetry Agent uses a different code path and is not subject to the same defect.

Attack Vector

Exploitation requires access to the logs rather than active network interaction with the device. An attacker with read access to local log files, remote syslog collections, TACACS+ accounting records, or SIEM archives can harvest device credentials, TACACS secret keys, SNMP community strings, and other secrets. The attacker can then reuse harvested credentials for lateral movement, privileged configuration changes, or persistence on the network infrastructure.

No synthetic exploitation code is provided. Refer to the Arista Security Advisory #0168 for authoritative technical details.

Detection Methods for CVE-2026-2380

Indicators of Compromise

Log entries in EOS accounting or command history containing strings such as secret, password, secret-key, or pre-shared-key followed by cleartext values.
Remote syslog or TACACS+ accounting records referencing OpenConfig paths like system/aaa/global/tacacs/config/secret-key.
RESTCONF or NETCONF audit entries showing full request bodies that include credential fields.

Detection Strategies

Grep archived EOS logs and SIEM indexes for YANG paths and CLI keywords that identify credential material.
Correlate configuration change events on gNMI, gNSI, RESTCONF, and NETCONF sessions with accounting log volume to locate exposure windows.
Review access logs on syslog collectors, TACACS+ servers, and log-storage backends to identify which principals have read affected records.

Monitoring Recommendations

Continuously scan centralized log platforms for high-entropy strings adjacent to credential keywords.
Alert on any read or export activity targeting historical EOS log archives.
Track authentication anomalies on network devices that could indicate reuse of harvested credentials.

How to Mitigate CVE-2026-2380

Immediate Actions Required

Apply the fixed EOS release identified in Arista Security Advisory #0168.
Rotate all credentials, TACACS+ and RADIUS shared secrets, SNMP communities, and pre-shared keys that were configured or modified through OpenConfig services on affected devices.
Purge or restrict access to historical log archives containing exposed secrets on both EOS devices and downstream collectors.

Patch Information

Arista has published fixed software versions and hotfix guidance in Security Advisory #0168. Consult the advisory for the specific EOS train and release that address the logging defect, and validate the patch on management infrastructure before broad deployment.

Workarounds

Disable OpenConfig services (gNMI, gNSI, RESTCONF, NETCONF) on devices where they are not required for operations.
Restrict accounting and syslog forwarding to trusted collectors only, using authenticated and encrypted transports.
Limit read access to EOS log files and remote log archives to a minimal set of administrators pending patch deployment.

bash

# Configuration example - see Arista Security Advisory #0168 for authoritative guidance
# Refer to https://www.arista.com/en/support/advisories-notices/security-advisory/24724-security-advisory-0168