{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101149", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-09-28T08:30:31.034Z", "datePublished": "2026-10-06T19:37:25.250Z", "dateUpdated": "2026-10-06T19:51:18.383Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-10-06T19:37:25.250Z"}, "title": "Security Advisory 0186", "descriptions": [{"lang": "en", "value": "Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.</p>"}]}], "affected": [{"vendor": "Arista Networks", "product": "CloudVision Portal", "platforms": ["CloudVision Portal, virtual appliance or physical appliance"], "defaultStatus": "unaffected", "versions": [{"version": "2026.2.0", "status": "affected", "versionType": "custom"}, {"version": "2026.1.0", "lessThanOrEqual": "2026.1.2", "status": "affected", "versionType": "custom"}, {"version": "2025.3.0", "lessThanOrEqual": "2025.3.3", "status": "affected", "versionType": "custom"}, {"version": "2020.3.0", "lessThan": "2025.3.0", "status": "affected", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "baseScore": 4.1, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N", "baseScore": 5.1, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server-Side Request Forgery"}]}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to CVE-2026-101149, OAuth SSO must be configured. To verify, navigate to Settings \u2192 Access Management \u2192 Authentication \u2192 SSO Providers. If any provider appears under the OAuth Providers section, OAuth SSO is configured. If no provider is listed, there is no exposure to this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In order to be vulnerable to CVE-2026-101149, OAuth SSO must be configured. To verify, navigate to <strong>Settings \u2192 Access Management \u2192 Authentication \u2192 SSO Providers</strong>. If any provider appears under the <strong>OAuth Providers</strong> section, OAuth SSO is configured. If no provider is listed, there is no exposure to this issue.</p>"}]}], "workarounds": [{"lang": "en", "value": "There is no configuration-based mitigation for this issue. However, operators can consider switching to an alternative non-OIDC SSO login method, if feasible. Additionally, restrict AAA settings and Account Management configuration permissions to trusted personnel only.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>There is no configuration-based mitigation for this issue. However, operators can consider switching to an alternative non-OIDC SSO login method, if feasible. Additionally, restrict AAA settings and Account Management configuration permissions to trusted personnel only.</p>"}]}], "solutions": [{"lang": "en", "value": "CVE-2026-101149 has been fixed in the following releases:\n- 2026.2.1 and later releases in the 2026.2.x train\n- 2026.1.3 and later releases in the 2026.1.x train\n- 2025.3.4 and later releases in the 2025.3.x train", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>CVE-2026-101149 has been fixed in the following releases:</p><ul><li>2026.2.1 and later releases in the 2026.2.x train</li><li>2026.1.3 and later releases in the 2026.1.x train</li><li>2025.3.4 and later releases in the 2025.3.x train</li></ul>"}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24802-security-advisory-0186", "tags": ["vendor-advisory"]}], "source": {"advisory": "Security Advisory 0186", "discovery": "INTERNAL", "defects": ["BUG 1919444"]}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T19:51:08.204808Z", "id": "CVE-2026-101149", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T19:51:18.383Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101149", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-09-28T08:30:31.034Z", "datePublished": "2026-10-06T19:37:25.250Z", "dateUpdated": "2026-10-06T19:51:18.383Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-10-06T19:37:25.250Z"}, "title": "Security Advisory 0186", "descriptions": [{"lang": "en", "value": "Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.</p>"}]}], "affected": [{"vendor": "Arista Networks", "product": "CloudVision Portal", "platforms": ["CloudVision Portal, virtual appliance or physical appliance"], "defaultStatus": "unaffected", "versions": [{"version": "2026.2.0", "status": "affected", "versionType": "custom"}, {"version": "2026.1.0", "lessThanOrEqual": "2026.1.2", "status": "affected", "versionType": "custom"}, {"version": "2025.3.0", "lessThanOrEqual": "2025.3.3", "status": "affected", "versionType": "custom"}, {"version": "2020.3.0", "lessThan": "2025.3.0", "status": "affected", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "baseScore": 4.1, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N", "baseScore": 5.1, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server-Side Request Forgery"}]}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to CVE-2026-101149, OAuth SSO must be configured. To verify, navigate to Settings \u2192 Access Management \u2192 Authentication \u2192 SSO Providers. If any provider appears under the OAuth Providers section, OAuth SSO is configured. If no provider is listed, there is no exposure to this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In order to be vulnerable to CVE-2026-101149, OAuth SSO must be configured. To verify, navigate to <strong>Settings \u2192 Access Management \u2192 Authentication \u2192 SSO Providers</strong>. If any provider appears under the <strong>OAuth Providers</strong> section, OAuth SSO is configured. If no provider is listed, there is no exposure to this issue.</p>"}]}], "workarounds": [{"lang": "en", "value": "There is no configuration-based mitigation for this issue. However, operators can consider switching to an alternative non-OIDC SSO login method, if feasible. Additionally, restrict AAA settings and Account Management configuration permissions to trusted personnel only.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>There is no configuration-based mitigation for this issue. However, operators can consider switching to an alternative non-OIDC SSO login method, if feasible. Additionally, restrict AAA settings and Account Management configuration permissions to trusted personnel only.</p>"}]}], "solutions": [{"lang": "en", "value": "CVE-2026-101149 has been fixed in the following releases:\n- 2026.2.1 and later releases in the 2026.2.x train\n- 2026.1.3 and later releases in the 2026.1.x train\n- 2025.3.4 and later releases in the 2025.3.x train", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>CVE-2026-101149 has been fixed in the following releases:</p><ul><li>2026.2.1 and later releases in the 2026.2.x train</li><li>2026.1.3 and later releases in the 2026.1.x train</li><li>2025.3.4 and later releases in the 2025.3.x train</li></ul>"}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24802-security-advisory-0186", "tags": ["vendor-advisory"]}], "source": {"advisory": "Security Advisory 0186", "discovery": "INTERNAL", "defects": ["BUG 1919444"]}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-101149", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T19:51:08.204808Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T19:51:14.208Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["CloudVision Portal, virtual appliance or physical appliance"], "product": "CloudVision Portal", "vendor": "Arista Networks", "versions": [{"status": "affected", "version": "2026.2.0", "versionType": "custom"}, {"lessThanOrEqual": "2026.1.2", "status": "affected", "version": "2026.1.0", "versionType": "custom"}, {"lessThanOrEqual": "2025.3.3", "status": "affected", "version": "2025.3.0", "versionType": "custom"}, {"lessThan": "2025.3.0", "status": "affected", "version": "2020.3.0", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations."}], "id": "CVE-2026-101149", "lastModified": "2026-10-06T20:17:08.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 1.4, "source": "psirt@arista.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@arista.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-101149", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-06T19:51:08.204808Z", "version": "2.0.3"}}]}, "published": "2026-10-06T20:17:08.773", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24802-security-advisory-0186"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}

{"created": "2026-10-06T21:15:06.660481+00:00", "title": "Arista CloudVision Portal OIDC Provider Configuration Redirection Vulnerability", "updated": "2026-10-06T21:15:06.660497+00:00", "vendors": []}