CVE-2026-73439: Security Advisory 0164
On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule for the same path is present in the policy. Under certain conditions, this can lead to an authenticated user gaining unauthorized permission to read or write gNMI paths that the Pathz policy is intended to restrict.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Arista EOSto a version that resolves this vulnerability.Fixed in 4.33.9M - Upgrade
Upgrade
Arista EOSto a version that resolves this vulnerability.Fixed in 4.34.7M - Upgrade
Upgrade
Arista EOSto a version that resolves this vulnerability.Fixed in 4.35.6M - Upgrade
Upgrade
Arista EOSto a version that resolves this vulnerability.Fixed in 4.36.1F - Compensating control
On affected Arista EOS systems where OpenConfig is configured with a gNMI server and gNSI Pathz is configured with a Pathz policy, modify the gNSI Pathz policy so that for any given path, you do not define both a group rule and a user rule for the same path (this is the condition under which gNMI may fail to correctly enforce Pathz policy rules).
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected Arista EOS platforms are exposed only when OpenConfig is configured, a gNMI server is running, gNSI Pathz is configured, and a gNSI Pathz policy is present.
What policy condition triggers the enforcement failure?
The issue occurs when the Pathz policy contains both a group rule and a user rule for the same gNMI path. Under certain conditions, gNMI may not correctly enforce the intended restrictions.
What access would an attacker need?
An attacker must be an authenticated user. Successful exploitation can grant unauthorized read or write access to gNMI paths that the Pathz policy was intended to restrict.
How can administrators identify potentially affected configurations?
Review systems running gNMI with gNSI Pathz enabled and inspect their Pathz policies for cases where both group and user rules apply to the same path.