CVE-2026-73461: EOS OpenConfig gRPC Auth Bypass Vulnerability

CVE-2026-73461 Overview

CVE-2026-73461 is a critical authorization flaw in Arista EOS platforms that expose gRPC access to OpenConfig with AAA-based authorization enabled. Authenticated gRPC requests to OpenConfig may execute with the wrong privilege level, causing the system to consult an incorrect AAA method list. The defect maps to [CWE-266] Incorrect Privilege Assignment. Non-gRPC OpenConfig transports such as NETCONF are not affected. Arista disclosed the issue in Arista Security Advisory #0163.

Critical Impact
An authenticated user issuing gRPC requests to OpenConfig can obtain authorization decisions based on the wrong AAA method list, potentially bypassing intended command restrictions on affected EOS switches and routers.

Affected Products

Arista EOS platforms with AAA-based gRPC authorization enabled for OpenConfig
OpenConfig service over gRPC transport on affected EOS versions
Deployments using AAA method lists to restrict OpenConfig operations

Discovery Timeline

2026-09-16 - CVE-2026-73461 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-73461

Vulnerability Analysis

The vulnerability resides in how Arista EOS applies Authentication, Authorization, and Accounting (AAA) policies to OpenConfig requests received over gRPC. Each AAA method list is bound to a privilege level, and administrators use these lists to constrain which operations an authenticated user may perform. On affected releases, gRPC OpenConfig requests are evaluated against the wrong privilege level. The AAA subsystem then selects a method list the operator did not intend, and the resulting authorization decision reflects that mismatched policy.

The issue is scoped to the gRPC OpenConfig code path. NETCONF, eAPI, and CLI paths process AAA context correctly and are not impacted.

Root Cause

The root cause is incorrect privilege assignment during request handling in the gRPC OpenConfig service. The service does not consistently propagate the authenticated user's effective privilege level into the AAA lookup, so the wrong method list is chosen. Because AAA method lists commonly gate write and configuration operations, the mismatch can grant an authenticated user access to operations that the intended method list would deny.

Attack Vector

Exploitation requires network reachability to the gRPC OpenConfig endpoint and valid credentials. An authenticated user with limited privileges can send OpenConfig gRPC requests and receive authorization outcomes governed by a method list intended for a different privilege level. Depending on how method lists are configured on the device, this can permit configuration changes or read access to sensitive state that should be restricted. No user interaction is required, and the attack is executed over the management network path used for streaming telemetry and configuration.

See the Arista Security Advisory #0163 for the definitive list of affected EOS trains and remediation.

Detection Methods for CVE-2026-73461

Indicators of Compromise

gRPC OpenConfig operations succeeding for users whose configured privilege level should be denied by the intended AAA method list.
AAA accounting records showing authorization decisions tied to a method list that does not match the user's assigned privilege level.
Unexpected configuration changes or Set RPCs originating from OpenConfig gRPC sessions of low-privilege accounts.

Detection Strategies

Correlate TACACS+ or RADIUS authorization logs with EOS AAA accounting to identify method-list mismatches on gRPC OpenConfig sessions.
Enable and review OpenConfig gRPC audit logging for Set, Replace, and Delete operations performed by non-administrative users.
Baseline expected OpenConfig clients and alert on new source addresses or client identities issuing write RPCs.

Monitoring Recommendations

Forward EOS syslog, AAA accounting, and gRPC access logs to a centralized analytics platform for retention and correlation.
Monitor TCP port 6030 and any custom OpenConfig gRPC ports for connections from unauthorized management subnets.
Alert on privilege-level anomalies where an authenticated principal performs operations outside their historical scope.

How to Mitigate CVE-2026-73461

Immediate Actions Required

Review the Arista Security Advisory #0163 and identify EOS devices running affected code trains with gRPC OpenConfig and AAA authorization enabled.
Restrict network access to the gRPC OpenConfig service to trusted management hosts using control-plane ACLs.
Audit accounts permitted to authenticate to OpenConfig and remove or reduce entitlements that are not operationally required.

Patch Information

Arista has published fixed EOS releases and hotfixes in Arista Security Advisory #0163. Operators should upgrade to a fixed EOS train that matches their currently deployed version, or apply the vendor-supplied hotfix if an upgrade is not immediately feasible.

Workarounds

Disable AAA-based gRPC authorization for OpenConfig where feasible and rely on NETCONF, which is not affected, until patching is complete.
Constrain OpenConfig gRPC access using management-plane ACLs so only administrative accounts on trusted jump hosts can reach the service.
Align AAA method lists across privilege levels so a mismatch does not grant elevated operations, and validate the configuration with test accounts.

bash

# Configuration example: restrict gRPC OpenConfig to a management subnet
management api gnmi
   transport grpc default
      ip access-group MGMT_ONLY in
!
ip access-list MGMT_ONLY
   10 permit tcp 10.0.10.0/24 any eq 6030
   20 deny  ip any any log