CVE-2026-73457: Arista EOS gNPSI Credential Disclosure

CVE-2026-73457 Overview

CVE-2026-73457 affects Arista EOS platforms with the gRPC Network Packet Sampling Interface (gNPSI) enabled. Under specific conditions, the gNPSI client credentials are written in clear text to local or remote accounting logs. Any authenticated user with access to those logs can read the credentials. The vulnerability is classified under [CWE-532: Insertion of Sensitive Information into Log File].

Critical Impact
Authenticated users with access to accounting logs can retrieve gNPSI client credentials in plaintext, enabling credential reuse against telemetry and network monitoring services.

Affected Products

Arista EOS with gNPSI enabled
Platforms exposing gRPC Network Packet Sampling Interface
Deployments forwarding accounting events to remote log collectors

Discovery Timeline

2026-09-16 - CVE CVE-2026-73457 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73457

Vulnerability Analysis

The flaw resides in how Arista EOS handles gNPSI authentication events. When the gNPSI service processes client authentication under certain conditions, the accounting subsystem records the associated credential material as part of the command or event context. These accounting records flow to local storage and to any configured remote destinations such as TACACS+ or syslog servers.

Because accounting logs are typically retained for compliance and readable by operators, network engineers, and log-management tooling, the credentials become accessible to a broader audience than intended. Attackers who compromise a low-privileged account with log-read permissions can harvest these credentials and reuse them against the gNPSI service to consume network packet sampling telemetry.

The issue is confidentiality-focused. It does not, on its own, provide integrity or availability impact, but the leaked credentials may enable follow-on actions against monitoring infrastructure.

Root Cause

The root cause is improper handling of sensitive authentication material in log output paths. The gNPSI code path fails to redact or hash credential fields before passing event data to the accounting framework, resulting in [CWE-532] behavior.

Attack Vector

Exploitation requires an authenticated user with permission to read local or remote accounting logs. No user interaction is needed beyond reading the log entries. The attacker parses the accounting records, extracts the plaintext gNPSI client credentials, and can then authenticate to the gNPSI endpoint as that client. See the Arista Security Advisory #0158 for authoritative technical details.

Detection Methods for CVE-2026-73457

Indicators of Compromise

Presence of gNPSI-related account or credential strings in aaa accounting log entries on EOS devices.
Unexpected reads of accounting logs by non-administrative accounts on TACACS+, RADIUS, or syslog collectors.
gNPSI client sessions originating from hosts that do not match the sanctioned collector inventory.

Detection Strategies

Search retained accounting logs for gNPSI command context containing credential-like fields, then rotate any credentials that appear.
Correlate access to accounting log stores with subsequent authentication attempts against gNPSI endpoints from new source addresses.
Baseline expected gNPSI clients and alert on authentications from unlisted principals or hosts.

Monitoring Recommendations

Forward EOS accounting logs to a centralized SIEM with strict role-based access control and audit trails on log access.
Enable alerts on repeated failed or anomalous gNPSI authentication events.
Periodically audit which identities can read accounting data across log-forwarding tiers.

How to Mitigate CVE-2026-73457

Immediate Actions Required

Review the Arista Security Advisory #0158 and identify EOS devices with gNPSI enabled.
Restrict read access to local and remote accounting logs to a minimal set of administrative accounts.
Rotate all gNPSI client credentials that may have appeared in accounting output.

Patch Information

Apply the fixed EOS release identified by Arista in Security Advisory #0158. Consult the advisory for the specific fixed versions that correspond to your deployed train.

Workarounds

Disable gNPSI on devices where it is not required until a fixed EOS version is installed.
Purge or truncate historical accounting logs that contain exposed credential material after rotation.
Limit remote accounting destinations to trusted collectors and enforce transport encryption on the log path.

bash

# Configuration example
# Restrict who can view accounting output on EOS
# (illustrative - validate against your operational policy)
username auditor role network-operator
aaa authorization exec default local
# After upgrading to the fixed EOS release, rotate gNPSI client credentials
# and confirm gNPSI clients re-authenticate successfully.