CVE-2026-17191
CriticalCVSS 9.1Exploitation Probability (EPSS)
High risk85th percentile - higher than 85% of all known CVEs
Summary
An input validation vulnerability exists in an API component of the Arista orchestrator. An authenticated user can manipulate backend queries, leading to unauthorized data access and unintended outbound network connections.
Risk Assessment
An authenticated attacker can access data beyond their privileges and cause the system to initiate unwanted network connections, potentially compromising data confidentiality and integrity.
Recommendation
Apply patches provided by Arista for the orchestrator and restrict API access to trusted users only.
Original NVD description (English source)
An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.