CVE-2026-73461

Arista EOS contains a privilege-assignment flaw (CWE-266) in which gRPC requests from an authenticated user to the OpenConfig interface may be evaluated at the wrong privilege level, causing authorization to run against the wrong AAA method list. It is triggered when a user sends a gRPC OpenConfig request to a device on which AAA-based gRPC authorization for OpenConfig is enabled; non-gRPC OpenConfig transports such as NETCONF are not affected. An attacker holding valid credentials could gain authorization for configuration changes or operations beyond their intended privileges, consistent with the 9.4 CVSS 4.0 score's high confidentiality, integrity, and availability impact. Only Arista EOS platforms with this specific gRPC/OpenConfig AAA configuration are affected. No exploitation in the wild, public proof-of-concept, or CISA KEV listing is currently known.

What to do: Inventory EOS devices for OpenConfig over gRPC and check whether AAA-based gRPC authorization is enabled; where present, restrict gRPC access to trusted management hosts via ACLs or management-plane filtering while awaiting the fixed release, since specific fixed EOS versions are not listed in the available data. Review AAA method lists and audit recent gRPC-authenticated sessions for activity performed at unintended privilege levels.