CVE-2026-73466: Arista EOS Information Disclosure Flaw

CVE-2026-73466 Overview

CVE-2026-73466 affects Arista Networks EOS (Extensible Operating System). Under specific conditions, user passwords may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. The issue is categorized under [CWE-532] (Insertion of Sensitive Information into Log File).

Exploitation requires authenticated local administrative access to the device shell. Non-standard debugging trace levels must also be explicitly enabled by an administrator. Arista discovered the issue internally and reports no observed exploitation in customer networks.

Critical Impact
Cleartext credentials in log files enable credential harvesting by any actor with local administrative shell access or read access to log storage.

Affected Products

Arista Networks EOS (specific versions listed in Arista Security Advisory #0153)
Deployments with non-standard debugging trace levels explicitly enabled
Systems where administrators or log aggregators have access to EOS log files

Discovery Timeline

2026-09-15 - CVE-2026-73466 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-73466

Vulnerability Analysis

The defect resides in EOS log handling when specialized non-standard debugging trace levels are turned on. Under these conditions, credential material supplied during user or configuration operations is written to log files without redaction. Any principal with read access to those logs can recover the cleartext passwords.

The exposure is not present with default logging configuration. It only manifests once an administrator explicitly enables the affected debug or trace verbosity. The exposure window persists for as long as the debugging levels remain active and the affected log data is retained.

Because EOS logs are often forwarded to remote syslog collectors and SIEM platforms, the sensitive data may propagate beyond the switch. This expands the population of accounts and systems that can access the exposed credentials.

Root Cause

The root cause is missing sanitization of credential fields in the code paths that emit high-verbosity debug messages. Password parameters passed to affected routines are serialized directly into log records rather than masked or omitted.

Attack Vector

The attack vector is local and requires high privileges. A malicious actor must already possess authenticated administrative shell access on the EOS device. They must also either wait for or induce use of the non-standard debug configuration, then read the resulting log files locally or on downstream log receivers. Refer to the Arista Security Advisory #0153 for the exact triggering conditions and affected components.

Detection Methods for CVE-2026-73466

Indicators of Compromise

Presence of non-standard trace or debug levels enabled in EOS running configuration or agent trace settings.
Log entries in /var/log/ or forwarded syslog streams containing recognizable password strings or credential fields.
Access to EOS log files by accounts or processes that do not normally consume switch logs.

Detection Strategies

Audit EOS configurations for trace or agent logging statements that raise verbosity beyond operational defaults.
Scan retained log archives and SIEM indexes for cleartext credential patterns originating from EOS hosts.
Correlate administrative shell sessions with changes to logging verbosity to identify who enabled affected trace levels.

Monitoring Recommendations

Alert on any change to EOS debug or trace configuration outside approved change windows.
Forward EOS syslog to a restricted collector and monitor for unusual read access to those indexes.
Track authentication and privileged shell activity on EOS devices to detect abuse of administrative access.

How to Mitigate CVE-2026-73466

Immediate Actions Required

Disable the non-standard debugging trace levels identified in Arista Security Advisory #0153 on all EOS devices.
Purge or sanitize existing log files and downstream SIEM data that may contain cleartext passwords.
Rotate credentials for any accounts whose passwords may have been captured while the affected trace levels were active.
Restrict administrative shell access on EOS devices to a minimal, audited set of operators.

Patch Information

Arista has published remediation details, including fixed EOS train versions and a hotfix where applicable, in Arista Security Advisory #0153. Apply the fixed release or hotfix that matches the deployed EOS train.

Workarounds

Leave EOS at default logging verbosity and avoid enabling the specialized non-standard debugging trace levels described in the advisory.
Constrain read access to EOS log files and downstream log stores to accounts with a documented operational need.
If elevated tracing is required for troubleshooting, capture logs to short-lived, access-controlled locations and delete them after the session.

bash

# Review and disable non-standard trace configuration on EOS
# Refer to Arista Security Advisory #0153 for the exact trace targets
show running-config | include trace
show agent logging
# Remove or lower the affected trace levels via the documented CLI,
# then verify no debug verbosity remains enabled.