CVE-2026-73445: Arista EOS gNSI Authz Auth Bypass Flaw

CVE-2026-73445 Overview

CVE-2026-73445 affects Arista EOS platforms that expose the gRPC Network Security Interface (gNSI) Authz.Rotate RPC. A flaw in the streaming policy rotation logic can activate the wrong authorization policy from an in-flight RPC stream. The result is an authorization policy state that does not match the intent of the operator issuing the rotation. Bootz is not affected. Arista discovered the issue internally and reports no known malicious exploitation in customer networks. The vulnerability is tracked under CWE-20: Improper Input Validation.

Critical Impact
An authenticated administrator invoking Authz.Rotate may cause an unintended Authz policy to become active on the device, altering enforced access control.

Affected Products

Arista EOS platforms exposing the gNSI Authz.Rotate RPC
Deployments using gNSI streaming policy rotation for authorization management
Bootz is explicitly not affected

Discovery Timeline

2026-09-16 - CVE-2026-73445 published to NVD
2026-09-16 - Last updated in NVD database
Discovered internally by Arista per Arista Security Advisory #0167

Technical Details for CVE-2026-73445

Vulnerability Analysis

The gNSI Authz service defines a Rotate RPC that lets an operator upload a new authorization policy over a bidirectional stream, validate it, and then finalize it as the active policy. The RPC is designed so that only the operator-confirmed policy at stream finalization should become active on the device. In affected EOS releases, the state machine that tracks the policy under negotiation can promote an incorrect policy from the ongoing stream to active status. This produces a divergence between the policy an administrator believes was committed and the policy actually enforced by EOS.

Because Authz governs which gRPC methods each authenticated principal may invoke, an incorrect active policy directly affects access decisions for management-plane services. The advisory scopes impact to integrity of the authorization configuration, with no direct effect on confidentiality or availability. Bootz, which handles secure zero-touch bootstrapping, uses a separate flow and is not affected.

Root Cause

The root cause is improper input validation and state handling in the Authz.Rotate RPC stream processing. The RPC handler fails to correctly bind the finalized policy to the specific validated payload from the stream, allowing the wrong policy content to be committed. See Arista Security Advisory #0167 for vendor detail.

Attack Vector

Exploitation requires network access to the gNSI endpoint and high privileges, since Authz.Rotate is an authenticated administrative RPC. No user interaction is required. An operator or automation client with the ability to invoke rotation can trigger the mismatch during a streamed rotation, resulting in an unintended active Authz policy. The advisory does not indicate that unauthenticated actors can drive the flaw.

No public proof-of-concept is available, and the vendor states there is no known malicious use in customer networks. Refer to the security advisory for technical details.

Detection Methods for CVE-2026-73445

Indicators of Compromise

Active Authz policy content on the device that does not match the policy last committed by the network management system or GitOps source of truth.
Authz.Rotate RPC sessions that terminate with a finalize step whose committed policy hash differs from the payload validated in the stream.
Unexpected authorization outcomes for gRPC method calls, such as principals gaining or losing access without a corresponding change record.

Detection Strategies

Compare the running Authz policy on each EOS device against the intended policy stored in configuration management after every rotation.
Enable and centralize EOS gNSI audit and accounting logs, then alert when policy hashes at commit time diverge from the payload uploaded during the stream.
Correlate management-plane authorization denials or new grants with recent Authz.Rotate events to surface silent policy drift.

Monitoring Recommendations

Ingest gNSI, AAA, and gRPC access logs into a SIEM or data lake and build alerts on Authz.Rotate completion events.
Monitor for repeated or interrupted Authz.Rotate streams on the same session, which increase the chance of an incorrect policy being finalized.
Track administrative gRPC access to network devices and alert on rotations performed outside approved change windows.

How to Mitigate CVE-2026-73445

Immediate Actions Required

Review Arista Security Advisory #0167 and identify EOS versions in scope for your fleet.
Audit the currently active Authz policy on every EOS device and reconcile it against the intended policy in source control.
Restrict gNSI access to a dedicated management network and to a minimal set of administrative principals until patched images are deployed.

Patch Information

Arista has published fixed EOS releases and remediation guidance in Arista Security Advisory #0167. Consult the advisory for the specific fixed train that maps to your deployed EOS version and upgrade affected devices following standard change management.

Workarounds

Avoid using the gNSI Authz.Rotate streaming flow on affected releases and manage authorization policies through an alternative supported mechanism until patched.
After any rotation, re-read the active policy through gNSI Authz.Get or equivalent and verify it matches the intended payload before treating the change as complete.
Limit which accounts and automation systems can invoke Authz.Rotate using device-level AAA controls and network ACLs on the gRPC management port.

bash

# Configuration example
# Refer to Arista Security Advisory #0167 for vendor-supplied
# remediation and upgrade guidance for your specific EOS train.