On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.
Examples of sensitive information include:
- Sensitive CLI commands (e.g., "username bob secret myPass")
- Sensitive OpenConfig YANG leafs (e.g., "system/aaa/global/tacacs/config/secret-key")
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
To be vulnerable to CVE-2026-2380, any of the following configurations must be present:
- gNMI server is enabled
- RESTCONF server is enabled
- NETCONF server is enabled
With any of these servers enabled, the OpenConfig/Octa agent can log sensitive information in the local log file.
gNMI server enabled:
#show running-config section gnmi
management api gnmi
transport grpc default
RESTCONF server enabled:
#show running-config section restconf
management api restconf
transport https default
ssl profile mySslProfile
NETCONF server enabled:
#show running-config section netconf
management api netconf
transport ssh default
In addition to local logging, sensitive information may be recorded on remote accounting servers if any of the following configurations are present:
gRPC AAA accounting sensitive logging (for gNMI only):
#show running-config section gnmi
management api gnmi
transport grpc default
accounting requests
gNSI.Acctz accounting sensitive logging (for gNMI only):
#show running-config section gnmi
management api gnmi
transport grpc default
#show running-config section gnsi
management api gnsi
service acctz
OpenConfig agent tracing sensitive logging (debug tracing enabled at any level):
#
trace OpenConfig setting /
Octa agent with debug tracing enabled (at any level):
#show running-config section trace | grep Octa
trace Octa setting /
The vulnerability can be mitigated by avoiding the transmission of requests containing sensitive information over gNMI, RESTCONF, or NETCONF. Additionally, debug tracing for the OpenConfig or Octa agents should not be enabled, i.e., do not configure "trace OpenConfig setting /" or "trace Octa setting /"; please note that this can only avoid sensitive information showing in the debug traces, but can not mitigate the issue cause by other configurations mentioned in the Required Configuration for Exploitation section.
Should it be determined that sensitive information has been logged, the affected log files must be truncated and any compromised secrets rotated to prevent unauthorized credential usage.
Use the following commands to clean up OpenConfig and Octa log files:
switch(config)# bash sudo truncate -s 0 /var/log/agents/OpenConfig
switch(config)# bash sudo truncate -s 0 /var/log/agents/Octa
Then use the following commands to clean up previously rotated old log files:
switch(config)# bash sudo find /var/log/agents -name 'OpenConfig.gz' -type f -delete
switch(config)# bash sudo find /var/log/agents -name 'Octa.gz' -type f -delete
The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.
CVE-2026-2380 has been fixed in the following releases:
- 4.36.2F and later releases in the 4.36.x train
No hotfix is available for this issue.