CVE-2026-73457 PUBLISHED

Under certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users.

Assigner: Arista
Reserved: 12.08.2026 Published: 16.09.2026 Updated: 16.09.2026

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticated users.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6

Product Status

Vendor Arista Networks
Product EOS
Versions Default: unaffected
  • affected from 4.36.0 to 4.36.1F (incl.)
  • affected from 4.35.0 to 4.35.5M (incl.)
  • affected from 4.34.2F to 4.34.7M (incl.)

Affected Configurations

In order to be vulnerable to CVE-2026-73457, gNPSI must be configured with trace facility EosRpcAuth enabled explicitly:

switch> show trace Gnpsi | grep Auth EosRpcAuth enabled 0123456789.

Systems remain unaffected if gNPSI is not enabled (default configuration):

switch> show management api gnpsi Enabled: no transports enabled

Workarounds

To secure the agent against  CVE-2026-73457, the service must be configured to use mutual TLS and only x509-spiffe authentication must be enabled.

management security    ssl profile P1       certificate server.crt key server.key       trust certificate ca_client.crt       chain certificate ca_signing.crt ! management api gnpsi    transport grpc t2       ssl profile P1       port 7001       authentication username priority x509-spiffe       no disabled

Logs are disabled by default, including the affected facility EosRpcAuth.To mitigate CVE-2026-73457, ensure the facility EosRpcAuth status is set to disabled. The command below can be used to restore all Gnpsi agent tracing to its default setting.

switch(config)# no trace Gnpsi setting

Should it be determined that sensitive information has been logged, the affected log files must be truncated and any compromised secrets rotated to prevent gNPSI client credentials leaking.

Use the following commands to clean up Gnpsi log files:

switch(config)# bash sudo truncate -s 0 /var/log/agents/Gnpsi*

Then use the following commands to clean up previously rotated old log files:

switch(config)# bash sudo find /var/log/agents -name 'Gnpsi*.gz' -type f -delete

Solutions

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73457 has been fixed in the following releases:

  • 4.36.2F and later releases in the 4.36.x train
  • 4.35.6M and later releases in the 4.35.x train
  • 4.34.8M and later releases in the 4.34.x train

Credits

  • This issue was discovered internally by Arista. finder

References

Problem Types

  • CWE-532 Insertion of Sensitive Information into Log File CWE

Impacts

  • CAPEC-118 Information Disclosure