CVE-2026-101152: Security Advisory 0187

Published Oct 6, 2026

Updated

Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision.

Affected Software

1 affected component

Arista CloudVision

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CloudVision to a version that resolves this vulnerability.
Fixed in 2025.3.4
Upgrade
Upgrade CloudVision to a version that resolves this vulnerability.
Fixed in 2026.1.3
Upgrade
Upgrade CloudVision to a version that resolves this vulnerability.
Fixed in 2026.2.1

Event History

Oct 6, 2026

CVE Published

via MITRE·07:37 PM

Data Sourced

via MITRE·07:37 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Organizations using Arista CloudVision with its SSO login flow are exposed when a user can be persuaded to click an attacker-crafted URL. The attacker does not need to authenticate, but user interaction is required.

What could an attacker obtain or do if exploitation succeeds?

The SSO flow can cause the identity provider to send authentication material to an attacker-controlled URL rather than CloudVision. The stated impact includes high confidentiality and integrity impact, with scope changed.

Is exploitation straightforward?

The advisory rates attack complexity as high. Exploitation still requires network access, no privileges, and a user clicking the crafted URL.