CVE-2026-17191: VeloCloud Orchestrator Flow Metrics API SQL Injection
An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VeloCloud Orchestrator (VCO)to a version that resolves this vulnerability.Fixed in 5.2.3.14 - Upgrade
Upgrade
VeloCloud Orchestrator (VCO)to a version that resolves this vulnerability.Fixed in 6.1.3.4 - Upgrade
Upgrade
VeloCloud Orchestrator (VCO)to a version that resolves this vulnerability.Fixed in 6.4.2.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17191?
The severity of CVE-2026-17191 is rated as critical with a score of 9.1.
How do I fix CVE-2026-17191?
To fix CVE-2026-17191, ensure that input validation is properly implemented in the Arista VeloCloud Orchestrator Flow Metrics API.
What type of vulnerability is CVE-2026-17191?
CVE-2026-17191 is an SQL injection vulnerability affecting the API component of the Arista VeloCloud Orchestrator.
Who can exploit CVE-2026-17191?
CVE-2026-17191 can be exploited by an authenticated user to manipulate backend queries.
What could be the consequences of exploiting CVE-2026-17191?
Exploiting CVE-2026-17191 may result in unauthorized access to data and unintended actions in the underlying system.