CVE-2026-73467: Arista EOS Information Disclosure Flaw

CVE-2026-73467 Overview

CVE-2026-73467 affects Arista Networks EOS devices configured with Terminal Access Controller Access-Control System Plus (TACACS+) authentication. Under specific circumstances, the operating system exposes plaintext shared secrets configured for TACACS+ servers. The exposure occurs through log files or accessible outputs, mapping to Sensitive Information in Log Files [CWE-532]. An attacker with local, high-privilege access can retrieve credentials used to authenticate the switch to centralized authentication infrastructure.

Critical Impact
Recovered TACACS+ shared secrets allow attackers to impersonate the network device to the authentication server, decrypt captured TACACS+ traffic, and expand access across the managed network.

Affected Products

Arista EOS (Extensible Operating System) — see the Arista Security Advisory #0153 for affected release trains
Devices with configured TACACS+ server shared secrets
Deployments where privileged users can access system logs or diagnostic outputs

Discovery Timeline

2026-09-15 - CVE-2026-73467 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73467

Vulnerability Analysis

The vulnerability belongs to the Information Disclosure class, specifically Insertion of Sensitive Information into Log File [CWE-532]. Arista EOS stores or emits TACACS+ shared secrets in plaintext under certain operational conditions. Shared secrets protect the confidentiality of authentication exchanges between network devices and TACACS+ servers. When a shared secret is exposed in cleartext to any actor with access to the log or output stream, the integrity of the authentication channel is broken.

Exploitation requires local access to the device and elevated privileges, and the attack complexity is high. Successful exploitation impacts confidentiality on the local system and cascades into confidentiality, integrity, and availability impacts on downstream systems that trust the same shared secret.

Root Cause

The root cause is improper handling of sensitive credential material during logging or command output generation. EOS fails to redact or mask the TACACS+ shared secret before writing it to a persistent or user-accessible location. This mirrors a common pattern in network operating systems where secrets configured through the command line are echoed back through diagnostic subsystems intended for troubleshooting.

Attack Vector

The attack vector is local. An authenticated user with sufficient privileges to read the affected log files, running configuration exports, or diagnostic outputs can retrieve the plaintext shared secret. User interaction is required as part of the exploitation chain. Once obtained, the shared secret enables the attacker to decrypt TACACS+ session traffic captured on the network, forge authentication requests, and pivot into other network devices that share the same secret. Refer to the Arista Security Advisory #0153 for the specific triggering conditions and configuration states.

Detection Methods for CVE-2026-73467

Indicators of Compromise

Access to EOS log files, show tech-support output, or configuration exports by accounts that do not typically perform maintenance tasks
TACACS+ authentication requests originating from unexpected source addresses using valid shared secrets
Unexplained privileged logins on other network devices that share the same TACACS+ shared secret

Detection Strategies

Audit EOS log files and diagnostic bundles for occurrences of the TACACS+ shared secret in cleartext
Correlate downloads or transfers of show tech-support archives with subsequent authentication anomalies on TACACS+ servers
Baseline administrator access patterns to EOS devices and alert on deviations, especially bulk log retrieval

Monitoring Recommendations

Forward EOS syslog and AAA accounting records to a centralized analytics platform for correlation across devices
Monitor TACACS+ server logs for authentication success from network elements that were recently accessed by administrators
Track configuration reads and file transfers off EOS devices using AAA command accounting

How to Mitigate CVE-2026-73467

Immediate Actions Required

Review the Arista Security Advisory #0153 to determine whether your EOS release and configuration are affected
Rotate all TACACS+ shared secrets on affected devices and on the corresponding TACACS+ servers
Restrict access to EOS log files, diagnostic bundles, and configuration exports to a minimum set of administrators
Purge historical show tech-support archives and log exports that may contain plaintext secrets

Patch Information

Arista Networks publishes fixed EOS release information in Arista Security Advisory #0153. Apply the vendor-recommended EOS release for your platform and hardware family. After upgrading, rotate the TACACS+ shared secrets, since previously exposed values remain compromised regardless of the patch.

Workarounds

Limit privileged CLI access to a small, audited group of operators until the patched EOS release is deployed
Use unique TACACS+ shared secrets per device or per site to constrain the blast radius of any single secret exposure
Encrypt and access-control any offline copies of EOS diagnostic output and configuration backups
Enforce AAA command accounting to record every access to logs and diagnostic commands on EOS devices

bash

# Rotate the TACACS+ shared secret on an EOS device
# Replace <NEW_SECRET> with a strong, unique value per device
switch# configure
switch(config)# no tacacs-server host 10.0.0.10
switch(config)# tacacs-server host 10.0.0.10 key 7 <NEW_SECRET>
switch(config)# end
switch# write memory