rootpwn

low · CVSS v3 3 · CVSS v4 2.1

CVE-2026-73442

On Arista EOS switches with VRRP enabled, the peer device’s VRRP authentication keys are written to the switch’s trace logs in cleartext. An

Overview

On Arista EOS switches with VRRP enabled, the peer device’s VRRP authentication keys are written to the switch’s trace logs in cleartext. An authenticated user with sufficient privileges can read these logs and obtain the credentials without needing network access to the VRRP segment.

Description

On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forwarded log output) to obtain the peer device VRRP authentication credentials without having access to the network segment on which VRRP is running.

Impact

Confidentiality: VRRP authentication credentials are exposed, enabling an attacker to impersonate a peer device or gain unauthorized control over VRRP-enabled interfaces. Integrity and availability are not directly affected.

Remediation

['Apply the vendor‑issued patch that removes VRRP authentication data from trace logs.', 'If a patch is not yet available, disable VRRP logging or configure the logging level to exclude authentication information.', 'Consider using stronger VRRP authentication mechanisms (e.g., MD5) and ensure that only trusted users have access to trace logs.']

Risk context

The vulnerability is rated low (CVSS v3 3.0, v4 2.1) and currently has no EPSS score. While the impact is limited to credential disclosure, it is still advisable to patch or mitigate promptly to prevent credential compromise.

Affected products

  • Arista EOS
  • Arista Networks EOS

Scores

Severity
low
CVSS v2
1.4
CVSS v3
3
CVSS v4
2.1
EPSS
—

Arista EOS VRRP credential disclosure logging network defense low severity

← All CVEs

Related CVEs

low

CVE-2026-20071

A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco Identity Services Engine (ISE) allows an unauthenticated, adjacent attacker to hijack an active onboarding session. The flaw results from insufficient authentication checks during the device onboarding phase. Exploitation enables the attacker to gain unauthorized access to protected 802.1X enterprise networks.

View analysis

low

CVE-2026-86071

Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile() validates only the final canonical file path, while LocalFolderExtractor.makeFile() creates intermediate path segments with unchecked mkdir() calls. An entry can therefore make the final path resolve inside the destination while causing intermediate directory creation outside it, enabling filesystem pollution or file-versus-directory squatting that can make later security-sensitive writes fail. The demonstrated impact is directory creation, not unconditional arbitrary file-content write. This issue is fixed in version 7.6.1.

View analysis

low

CVE-2026-92359

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function create_strands_app of the file integrations/aws-strands/python/src/ag_ui_strands/utils.py of the component CORSMiddleware. The manipulation results in permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is described as difficult. Upgrading to version [email protected] is sufficient to fix this issue. The patch is identified as 9b143b9668fa52c2054ede9d34a45ac4b4401089. It is suggested to upgrade the affected component.

View analysis

low

CVE-2026-91708

A race condition in Chrome’s network stack (prior to 153.0.8010.47) lets a remote attacker who has already compromised the renderer process read cross‑origin data from a crafted HTML page. The flaw is limited to situations where the renderer is already under attacker control, but it can expose sensitive information across origins.

View analysis