CVE-2026-73439: Arista EOS gNMI Auth Bypass Vulnerability

CVE-2026-73439 Overview

CVE-2026-73439 is an authorization flaw in Arista EOS affecting the gRPC Network Management Interface (gNMI) server when OpenConfig and gRPC Network Security Interface (gNSI) Pathz are configured. When a Pathz policy contains both a group rule and a user rule targeting the same path, gNMI may fail to enforce the intended restrictions. An authenticated user can gain unauthorized read or write access to gNMI paths that the Pathz policy was designed to restrict. The issue is tracked under [CWE-842: Placement of User into Incorrect Group], and is documented in Arista Security Advisory #0164.

Critical Impact

Authenticated users can bypass Pathz policy restrictions and read or modify network configuration paths intended to be off-limits, undermining role-based access control on production network devices.

Affected Products

• Arista EOS platforms with OpenConfig enabled and a running gNMI server
• Arista EOS deployments configured with gNSI Pathz policies
• Arista EOS configurations containing overlapping group and user Pathz rules for the same path

Discovery Timeline

• 2026-09-16 - CVE-2026-73439 published to the National Vulnerability Database
• 2026-09-17 - Last updated in the NVD database

Technical Details for CVE-2026-73439

Vulnerability Analysis

The flaw resides in how the gNMI server evaluates gNSI Pathz authorization policies on Arista EOS. Pathz allows administrators to define fine-grained rules controlling which users and groups can read or write specific OpenConfig paths. When a policy contains both a group-scoped rule and a user-scoped rule that reference the same path, the enforcement logic can select the wrong rule during authorization. The result is that a request may be evaluated against a permissive rule instead of the intended restrictive one.

This is an authorization inconsistency rather than a memory-safety or code-execution defect. Confidentiality and integrity of managed configuration data are both at risk because gNMI supports read (Get, Subscribe) and write (Set) semantics against network device state.

Root Cause

The root cause is classified as [CWE-842], improper placement of a user into an incorrect authorization context. When overlapping rule scopes exist for the same path, the policy evaluator does not deterministically apply the more specific or more restrictive rule. Instead, one rule can shadow the other, granting an authenticated principal effective permissions that the policy author did not intend.

Attack Vector

Exploitation requires network access to the gNMI endpoint and valid credentials on the target Arista EOS device. The attacker authenticates over gRPC and issues gNMI requests against paths covered by the misapplied Pathz rules. Because the flaw is triggered by the policy structure itself, no exploit chain or memory corruption is required. Any authenticated user whose group membership overlaps with a user-scoped rule on the same path may benefit from the incorrect enforcement and access restricted OpenConfig paths.

No verified proof-of-concept code is publicly available. See Arista Security Advisory #0164 for vendor-provided technical details.

Detection Methods for CVE-2026-73439

Indicators of Compromise

• Successful gNMI Get, Subscribe, or Set operations from user accounts against OpenConfig paths that Pathz policy documents as restricted.
• Configuration changes on EOS devices originating over gNMI without a corresponding change-management ticket or approved automation identity.
• Pathz policy files containing both group-scoped and user-scoped rules that reference the same OpenConfig path.

Detection Strategies

• Audit active Pathz policies for overlapping rules where the same path is referenced by both a group entry and a user entry, and flag these as high-risk configurations.
• Correlate gNMI accounting and syslog events with the effective Pathz policy to identify requests that succeeded despite policy intent to deny.
• Baseline expected gNMI callers (automation service accounts, controllers) and alert on gNMI activity from interactive user identities.

Monitoring Recommendations

• Forward EOS AAA, gNMI, and gNSI logs to a centralized analytics platform and retain them for post-incident review.
• Monitor for unexpected Set operations on sensitive OpenConfig subtrees such as /system, /interfaces, and routing configuration.
• Alert on new or modified Pathz policy files pushed to production devices outside of approved change windows.

How to Mitigate CVE-2026-73439

Immediate Actions Required

• Review every deployed gNSI Pathz policy and remove or restructure rules where a group entry and a user entry target the same path.
• Restrict network reachability to the gNMI TCP port to trusted management networks and controller hosts only.
• Rotate credentials for any account whose Pathz-restricted paths may have been accessed while the vulnerable configuration was live.

Patch Information

Refer to Arista Security Advisory #0164 for the list of fixed EOS releases and the recommended upgrade path. Apply the vendor-provided fixed release across all EOS devices where OpenConfig and gNSI Pathz are enabled.

Workarounds

• Rewrite Pathz policies to use either group-scoped or user-scoped rules per path, eliminating overlap that triggers the enforcement flaw.
• Disable the gNMI server on EOS devices that do not require OpenConfig-based management until the fixed release is deployed.
• Enforce least privilege at the AAA layer so that gNMI users have the minimum group membership needed for their function.

# Configuration example: restrict gNMI to a management VRF and trusted ACL
management api gnmi
   transport grpc default
      vrf MGMT
      ip access-group GNMI-ALLOW in
!
ip access-list GNMI-ALLOW
   10 permit tcp 10.10.0.0/24 any eq 6030
   20 deny  ip any any log