CVE-2026-73461

HighCVSS 8.0/10Last modified Sep 17, 2026

Description

On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-266

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 16, 2026
Last modified: Sep 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-734626.5On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs CVE-2026-734635.3On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition i CVE-2026-734648.8On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a ma CVE-2026-734656.3On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files durin CVE-2026-734666.3On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during opera CVE-2026-734676.3On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Acc CVE-2026-734686.5A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in tem CVE-2026-734695.8When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be s CVE-2026-73478.1Use after free in Chromoting in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via malicious netw CVE-2026-734709.8Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delega CVE-2026-734745.3Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity CVE-2026-734759.1Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from