CVE-2026-73463: Arista EOS gNSI Authz Privilege Escalation

CVE-2026-73463 Overview

CVE-2026-73463 is a race condition in the gRPC Network Security Interface (gNSI) Authz service on Arista EOS. When operators configure multiple gNSI transports, a policy rotation can fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. Arista discovered the flaw internally and reports no observed exploitation in customer networks. The Bootz service is not affected. The vulnerability is tracked under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization).

Critical Impact

A revoked user retains authorized access to gRPC management interfaces after an Authz policy rotation, undermining access control enforcement on affected Arista EOS devices.

Affected Products

• Arista EOS running the gNSI Authz service
• Deployments with multiple gNSI transports configured concurrently
• gRPC management interfaces exposed via gNSI

Discovery Timeline

• 2026-09-16 - CVE-2026-73463 published to the National Vulnerability Database
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73463

Vulnerability Analysis

The gNSI Authz service manages authorization policies for gRPC interfaces on Arista EOS. Administrators rotate policies to add, modify, or revoke access for authenticated principals. When operators configure more than one gNSI transport, concurrent code paths in the Authz service update policy state without adequate synchronization. The rotation appears to succeed but does not consistently apply the new policy across every transport. A previously authenticated user whose privileges were revoked can continue issuing gRPC calls that the new policy was meant to block. The failure is silent, so operators receive no error signal that enforcement drifted from intent. The Bootz service uses a different code path and is not affected.

Root Cause

The root cause is a concurrency defect classified as [CWE-362]. Multiple gNSI transports mutate shared authorization state during rotation. The absence of proper serialization allows one transport to complete rotation while another retains stale policy references. Authenticated sessions established under the prior policy continue to be evaluated against outdated authorization data.

Attack Vector

Exploitation requires an authenticated user with existing gRPC access whose credentials remain valid. The attacker does not need to trigger the race directly. If a rotation intended to revoke their access executes while multiple transports are active, the attacker may continue using gRPC interfaces beyond the intended revocation. Attack complexity is high because the outcome depends on transport timing, and the attacker must already hold low-privilege authenticated access.

See the Arista Security Advisory #0169 for technical details on affected releases and fixed versions.

Detection Methods for CVE-2026-73463

Indicators of Compromise

• gRPC API calls from user accounts that were expected to be revoked during a recent gNSI Authz policy rotation.
• Divergence between the intended Authz policy content and the effective policy reported by different gNSI transports.
• Successful gRPC operations occurring after an administrator confirmed policy rotation for the calling identity.

Detection Strategies

• Audit gNSI Authz policy rotation events and correlate them with subsequent gRPC session activity per user.
• Compare active gRPC session identities against the current authorization policy to identify stale privilege retention.
• Enable structured logging on all configured gNSI transports and reconcile applied policy versions across transports.

Monitoring Recommendations

• Alert on gRPC authentication or method invocation by identities that recent policy changes were intended to remove.
• Track policy rotation success signals across every gNSI transport and flag transports that lag or diverge.
• Forward Arista EOS management-plane telemetry into a centralized analytics platform to detect authorization drift over time.

How to Mitigate CVE-2026-73463

Immediate Actions Required

• Review the Arista Security Advisory #0169 and identify EOS versions running in the environment that expose the gNSI Authz service.
• Inventory devices configured with multiple gNSI transports, as those configurations are the precondition for the race condition.
• After any Authz policy rotation intended to revoke access, force disconnection of existing gRPC sessions for the affected principals.

Patch Information

Arista has published fixed release information in Security Advisory #0169. Upgrade affected Arista EOS devices to a release identified as fixed in that advisory. Validate policy enforcement after upgrade by testing that revoked identities can no longer authenticate to gRPC interfaces across every configured transport.

Workarounds

• Where operationally feasible, reduce the number of concurrently configured gNSI transports to eliminate the race window during Authz policy rotation.
• After each policy rotation, verify effective policy on each transport and terminate active gRPC sessions for revoked users to force re-authorization.
• Restrict network reachability to gRPC management interfaces using management-plane access control lists so only trusted administrative networks can reach gNSI.