CVE-2026-2380 (GCVE-0-2026-2380)
Vulnerability from cvelistv5
Published
2026-09-16 08:48
Modified
2026-09-16 14:07
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
CWE
  • CWE-256 - Plaintext Storage of a Password
Summary
On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability. Examples of sensitive information include: - Sensitive CLI commands (e.g., "username bob secret myPass") - Sensitive OpenConfig YANG leafs (e.g., "system/aaa/global/tacacs/config/secret-key") This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
References
Impacted products
Vendor Product Version
Arista Networks EOS Version: 4.36.0F   <
Version: 4.35.0F   < 4.36.0F
Version: 4.34.0F   < 4.35.0F
Version: 4.33.0F   < 4.34.0F
Version: 0   < 4.33.0F
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-2380",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T14:01:30.909167Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T14:07:36.480Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "710 Series",
            "720D Series",
            "720XP/722XPM Series",
            "750X Series",
            "7010TX Series",
            "7020R/R4 Series",
            "7130 Series running EOS",
            "7170 Series",
            "7050X3/X4 Series",
            "7060X/X2/X4/X5/X6 Series",
            "7260X/X3 Series",
            "7280R/R2/R3/R4 Series",
            "7300X/X3 Series",
            "7320X Series",
            "7358X4 Series",
            "7368X4 Series",
            "7388X5 Series",
            "7500R/R2/R3 Series",
            "7800R3/R4 Series",
            "7700R4 Series",
            "AWE 5000 Series",
            "AWE 7200R Series",
            "CloudEOS",
            "cEOS-lab",
            "vEOS-lab",
            "CloudVision eXchange, virtual or physical appliance"
          ],
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "lessThanOrEqual": "4.36.1F",
              "status": "affected",
              "version": "4.36.0F",
              "versionType": "custom"
            },
            {
              "lessThan": "4.36.0F",
              "status": "affected",
              "version": "4.35.0F",
              "versionType": "custom"
            },
            {
              "lessThan": "4.35.0F",
              "status": "affected",
              "version": "4.34.0F",
              "versionType": "custom"
            },
            {
              "lessThan": "4.34.0F",
              "status": "affected",
              "version": "4.33.0F",
              "versionType": "custom"
            },
            {
              "lessThan": "4.33.0F",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eTo be vulnerable to CVE-2026-2380, any of the following configurations must be present:\u003c/p\u003e\u003col\u003e\u003cli\u003egNMI server is enabled\u003c/li\u003e\u003cli\u003eRESTCONF server is enabled\u003c/li\u003e\u003cli\u003eNETCONF server is enabled\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eWith any of these servers enabled, the OpenConfig/Octa agent can log sensitive information in the local log file.\u003c/p\u003e\u003cp\u003egNMI server enabled:\u003c/p\u003e\u003cpre\u003e#show running-config section gnmi\nmanagement api gnmi\n   transport grpc default\u003c/pre\u003e\u003cp\u003eRESTCONF server enabled:\u003c/p\u003e\u003cpre\u003e#show running-config section restconf\nmanagement api restconf\n   transport https default\n      ssl profile mySslProfile\u003c/pre\u003e\u003cp\u003eNETCONF server enabled:\u003c/p\u003e\u003cpre\u003e#show running-config section netconf\nmanagement api netconf\n   transport ssh default\u003c/pre\u003e\u003cp\u003eIn addition to local logging, sensitive information may be recorded on remote accounting servers if any of the following configurations are present:\u003c/p\u003e\u003cp\u003egRPC AAA accounting sensitive logging (for gNMI only):\u003c/p\u003e\u003cpre\u003e#show running-config section gnmi\nmanagement api gnmi\n   transport grpc default\n      accounting requests\u003c/pre\u003e\u003cp\u003egNSI.Acctz accounting sensitive logging (for gNMI only):\u003c/p\u003e\u003cpre\u003e#show running-config section gnmi\nmanagement api gnmi\n   transport grpc default\n#show running-config section gnsi\nmanagement api gnsi\n   service acctz\u003c/pre\u003e\u003cp\u003eOpenConfig agent tracing sensitive logging (debug tracing enabled at any level):\u003c/p\u003e\u003cpre\u003e#\ntrace OpenConfig setting */*\u003c/pre\u003e\u003cp\u003eOcta agent with debug tracing enabled (at any level):\u003c/p\u003e\u003cpre\u003e#show running-config section trace | grep Octa\ntrace Octa setting */*\u003c/pre\u003e"
            }
          ],
          "value": "To be vulnerable to CVE-2026-2380, any of the following configurations must be present:\n\n1. gNMI server is enabled\n2. RESTCONF server is enabled\n3. NETCONF server is enabled\n\nWith any of these servers enabled, the OpenConfig/Octa agent can log sensitive information in the local log file.\n\ngNMI server enabled:\n\n  #show running-config section gnmi\n  management api gnmi\n     transport grpc default\n\nRESTCONF server enabled:\n\n  #show running-config section restconf\n  management api restconf\n     transport https default\n        ssl profile mySslProfile\n\nNETCONF server enabled:\n\n  #show running-config section netconf\n  management api netconf\n     transport ssh default\n\nIn addition to local logging, sensitive information may be recorded on remote accounting servers if any of the following configurations are present:\n\ngRPC AAA accounting sensitive logging (for gNMI only):\n\n  #show running-config section gnmi\n  management api gnmi\n     transport grpc default\n        accounting requests\n\ngNSI.Acctz accounting sensitive logging (for gNMI only):\n\n  #show running-config section gnmi\n  management api gnmi\n     transport grpc default\n  #show running-config section gnsi\n  management api gnsi\n     service acctz\n\nOpenConfig agent tracing sensitive logging (debug tracing enabled at any level):\n\n  #\n  trace OpenConfig setting */*\n\nOcta agent with debug tracing enabled (at any level):\n\n  #show running-config section trace | grep Octa\n  trace Octa setting */*"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOn affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.\u003c/p\u003e\u003cp\u003eExamples of sensitive information include:\u003c/p\u003e\u003cul\u003e\u003cli\u003eSensitive CLI commands (e.g., \u0026quot;username bob secret myPass\u0026quot;)\u003c/li\u003e\u003cli\u003eSensitive OpenConfig YANG leafs (e.g., \u0026quot;system/aaa/global/tacacs/config/secret-key\u0026quot;)\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\u003c/p\u003e"
            }
          ],
          "value": "On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.\n\nExamples of sensitive information include:\n- Sensitive CLI commands (e.g., \"username bob secret myPass\")\n- Sensitive OpenConfig YANG leafs (e.g., \"system/aaa/global/tacacs/config/secret-key\")\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-256",
              "description": "CWE-256 Plaintext Storage of a Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T10:13:36.641Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "name": "Security Advisory 0168",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24724-security-advisory-0168"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-2380 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e"
            }
          ],
          "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-2380 has been fixed in the following releases:\n- 4.36.2F and later releases in the 4.36.x train\n\nNo hotfix is available for this issue."
        }
      ],
      "source": {
        "advisory": "Security Advisory 0168",
        "defects": [
          "BUG 1207374"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Security Advisory 0168",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerability can be mitigated by avoiding the transmission of requests containing sensitive information over gNMI, RESTCONF, or NETCONF. Additionally, debug tracing for the OpenConfig or Octa agents should not be enabled, i.e., do not configure \u0026quot;trace OpenConfig setting */*\u0026quot; or \u0026quot;trace Octa setting */*\u0026quot;; please note that this can only avoid sensitive information showing in the debug traces, but can not mitigate the issue cause by other configurations mentioned in the Required Configuration for Exploitation section.\u003c/p\u003e\u003cp\u003eShould it be determined that sensitive information has been logged, the affected log files must be truncated and any compromised secrets rotated to prevent unauthorized credential usage.\u003c/p\u003e\u003cp\u003eUse the following commands to clean up OpenConfig and Octa log files:\u003c/p\u003e\u003cpre\u003eswitch(config)# bash sudo truncate -s 0 /var/log/agents/OpenConfig*\nswitch(config)# bash sudo truncate -s 0 /var/log/agents/Octa*\u003c/pre\u003e\u003cp\u003eThen use the following commands to clean up previously rotated old log files:\u003c/p\u003e\u003cpre\u003eswitch(config)# bash sudo find /var/log/agents -name \u0027OpenConfig*.gz\u0027 -type f -delete\nswitch(config)# bash sudo find /var/log/agents -name \u0027Octa*.gz\u0027 -type f -delete\u003c/pre\u003e"
            }
          ],
          "value": "The vulnerability can be mitigated by avoiding the transmission of requests containing sensitive information over gNMI, RESTCONF, or NETCONF. Additionally, debug tracing for the OpenConfig or Octa agents should not be enabled, i.e., do not configure \"trace OpenConfig setting */*\" or \"trace Octa setting */*\"; please note that this can only avoid sensitive information showing in the debug traces, but can not mitigate the issue cause by other configurations mentioned in the Required Configuration for Exploitation section.\n\nShould it be determined that sensitive information has been logged, the affected log files must be truncated and any compromised secrets rotated to prevent unauthorized credential usage.\n\nUse the following commands to clean up OpenConfig and Octa log files:\n\n  switch(config)# bash sudo truncate -s 0 /var/log/agents/OpenConfig*\n  switch(config)# bash sudo truncate -s 0 /var/log/agents/Octa*\n\nThen use the following commands to clean up previously rotated old log files:\n\n  switch(config)# bash sudo find /var/log/agents -name \u0027OpenConfig*.gz\u0027 -type f -delete\n  switch(config)# bash sudo find /var/log/agents -name \u0027Octa*.gz\u0027 -type f -delete"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2026-2380",
    "datePublished": "2026-09-16T08:48:53.473Z",
    "dateReserved": "2026-02-11T21:25:18.920Z",
    "dateUpdated": "2026-09-16T14:07:36.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-2380\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-16T14:01:30.909167Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-16T14:01:38.003Z\"}}], \"cna\": {\"title\": \"Security Advisory 0168\", \"source\": {\"defects\": [\"BUG 1207374\"], \"advisory\": \"Security Advisory 0168\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.4, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.1, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Arista Networks\", \"product\": \"EOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.36.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.36.1F\"}, {\"status\": \"affected\", \"version\": \"4.35.0F\", \"lessThan\": \"4.36.0F\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.34.0F\", \"lessThan\": \"4.35.0F\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.33.0F\", \"lessThan\": \"4.34.0F\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.33.0F\", \"versionType\": \"custom\"}], \"platforms\": [\"710 Series\", \"720D Series\", \"720XP/722XPM Series\", \"750X Series\", \"7010TX Series\", \"7020R/R4 Series\", \"7130 Series running EOS\", \"7170 Series\", \"7050X3/X4 Series\", \"7060X/X2/X4/X5/X6 Series\", \"7260X/X3 Series\", \"7280R/R2/R3/R4 Series\", \"7300X/X3 Series\", \"7320X Series\", \"7358X4 Series\", \"7368X4 Series\", \"7388X5 Series\", \"7500R/R2/R3 Series\", \"7800R3/R4 Series\", \"7700R4 Series\", \"AWE 5000 Series\", \"AWE 7200R Series\", \"CloudEOS\", \"cEOS-lab\", \"vEOS-lab\", \"CloudVision eXchange, virtual or physical appliance\"], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\\n\\nCVE-2026-2380 has been fixed in the following releases:\\n- 4.36.2F and later releases in the 4.36.x train\\n\\nNo hotfix is available for this issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-2380 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisory/24724-security-advisory-0168\", \"name\": \"Security Advisory 0168\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"The vulnerability can be mitigated by avoiding the transmission of requests containing sensitive information over gNMI, RESTCONF, or NETCONF. Additionally, debug tracing for the OpenConfig or Octa agents should not be enabled, i.e., do not configure \\\"trace OpenConfig setting */*\\\" or \\\"trace Octa setting */*\\\"; please note that this can only avoid sensitive information showing in the debug traces, but can not mitigate the issue cause by other configurations mentioned in the Required Configuration for Exploitation section.\\n\\nShould it be determined that sensitive information has been logged, the affected log files must be truncated and any compromised secrets rotated to prevent unauthorized credential usage.\\n\\nUse the following commands to clean up OpenConfig and Octa log files:\\n\\n  switch(config)# bash sudo truncate -s 0 /var/log/agents/OpenConfig*\\n  switch(config)# bash sudo truncate -s 0 /var/log/agents/Octa*\\n\\nThen use the following commands to clean up previously rotated old log files:\\n\\n  switch(config)# bash sudo find /var/log/agents -name \u0027OpenConfig*.gz\u0027 -type f -delete\\n  switch(config)# bash sudo find /var/log/agents -name \u0027Octa*.gz\u0027 -type f -delete\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe vulnerability can be mitigated by avoiding the transmission of requests containing sensitive information over gNMI, RESTCONF, or NETCONF. Additionally, debug tracing for the OpenConfig or Octa agents should not be enabled, i.e., do not configure \u0026quot;trace OpenConfig setting */*\u0026quot; or \u0026quot;trace Octa setting */*\u0026quot;; please note that this can only avoid sensitive information showing in the debug traces, but can not mitigate the issue cause by other configurations mentioned in the Required Configuration for Exploitation section.\u003c/p\u003e\u003cp\u003eShould it be determined that sensitive information has been logged, the affected log files must be truncated and any compromised secrets rotated to prevent unauthorized credential usage.\u003c/p\u003e\u003cp\u003eUse the following commands to clean up OpenConfig and Octa log files:\u003c/p\u003e\u003cpre\u003eswitch(config)# bash sudo truncate -s 0 /var/log/agents/OpenConfig*\\nswitch(config)# bash sudo truncate -s 0 /var/log/agents/Octa*\u003c/pre\u003e\u003cp\u003eThen use the following commands to clean up previously rotated old log files:\u003c/p\u003e\u003cpre\u003eswitch(config)# bash sudo find /var/log/agents -name \u0027OpenConfig*.gz\u0027 -type f -delete\\nswitch(config)# bash sudo find /var/log/agents -name \u0027Octa*.gz\u0027 -type f -delete\u003c/pre\u003e\", \"base64\": false}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.\\n\\nExamples of sensitive information include:\\n- Sensitive CLI commands (e.g., \\\"username bob secret myPass\\\")\\n- Sensitive OpenConfig YANG leafs (e.g., \\\"system/aaa/global/tacacs/config/secret-key\\\")\\n\\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eOn affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.\u003c/p\u003e\u003cp\u003eExamples of sensitive information include:\u003c/p\u003e\u003cul\u003e\u003cli\u003eSensitive CLI commands (e.g., \u0026quot;username bob secret myPass\u0026quot;)\u003c/li\u003e\u003cli\u003eSensitive OpenConfig YANG leafs (e.g., \u0026quot;system/aaa/global/tacacs/config/secret-key\u0026quot;)\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-256\", \"description\": \"CWE-256 Plaintext Storage of a Password\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"To be vulnerable to CVE-2026-2380, any of the following configurations must be present:\\n\\n1. gNMI server is enabled\\n2. RESTCONF server is enabled\\n3. NETCONF server is enabled\\n\\nWith any of these servers enabled, the OpenConfig/Octa agent can log sensitive information in the local log file.\\n\\ngNMI server enabled:\\n\\n  #show running-config section gnmi\\n  management api gnmi\\n     transport grpc default\\n\\nRESTCONF server enabled:\\n\\n  #show running-config section restconf\\n  management api restconf\\n     transport https default\\n        ssl profile mySslProfile\\n\\nNETCONF server enabled:\\n\\n  #show running-config section netconf\\n  management api netconf\\n     transport ssh default\\n\\nIn addition to local logging, sensitive information may be recorded on remote accounting servers if any of the following configurations are present:\\n\\ngRPC AAA accounting sensitive logging (for gNMI only):\\n\\n  #show running-config section gnmi\\n  management api gnmi\\n     transport grpc default\\n        accounting requests\\n\\ngNSI.Acctz accounting sensitive logging (for gNMI only):\\n\\n  #show running-config section gnmi\\n  management api gnmi\\n     transport grpc default\\n  #show running-config section gnsi\\n  management api gnsi\\n     service acctz\\n\\nOpenConfig agent tracing sensitive logging (debug tracing enabled at any level):\\n\\n  #\\n  trace OpenConfig setting */*\\n\\nOcta agent with debug tracing enabled (at any level):\\n\\n  #show running-config section trace | grep Octa\\n  trace Octa setting */*\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eTo be vulnerable to CVE-2026-2380, any of the following configurations must be present:\u003c/p\u003e\u003col\u003e\u003cli\u003egNMI server is enabled\u003c/li\u003e\u003cli\u003eRESTCONF server is enabled\u003c/li\u003e\u003cli\u003eNETCONF server is enabled\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eWith any of these servers enabled, the OpenConfig/Octa agent can log sensitive information in the local log file.\u003c/p\u003e\u003cp\u003egNMI server enabled:\u003c/p\u003e\u003cpre\u003e#show running-config section gnmi\\nmanagement api gnmi\\n   transport grpc default\u003c/pre\u003e\u003cp\u003eRESTCONF server enabled:\u003c/p\u003e\u003cpre\u003e#show running-config section restconf\\nmanagement api restconf\\n   transport https default\\n      ssl profile mySslProfile\u003c/pre\u003e\u003cp\u003eNETCONF server enabled:\u003c/p\u003e\u003cpre\u003e#show running-config section netconf\\nmanagement api netconf\\n   transport ssh default\u003c/pre\u003e\u003cp\u003eIn addition to local logging, sensitive information may be recorded on remote accounting servers if any of the following configurations are present:\u003c/p\u003e\u003cp\u003egRPC AAA accounting sensitive logging (for gNMI only):\u003c/p\u003e\u003cpre\u003e#show running-config section gnmi\\nmanagement api gnmi\\n   transport grpc default\\n      accounting requests\u003c/pre\u003e\u003cp\u003egNSI.Acctz accounting sensitive logging (for gNMI only):\u003c/p\u003e\u003cpre\u003e#show running-config section gnmi\\nmanagement api gnmi\\n   transport grpc default\\n#show running-config section gnsi\\nmanagement api gnsi\\n   service acctz\u003c/pre\u003e\u003cp\u003eOpenConfig agent tracing sensitive logging (debug tracing enabled at any level):\u003c/p\u003e\u003cpre\u003e#\\ntrace OpenConfig setting */*\u003c/pre\u003e\u003cp\u003eOcta agent with debug tracing enabled (at any level):\u003c/p\u003e\u003cpre\u003e#show running-config section trace | grep Octa\\ntrace Octa setting */*\u003c/pre\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"shortName\": \"Arista\", \"dateUpdated\": \"2026-09-16T10:13:36.641Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-2380\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-16T14:07:36.480Z\", \"dateReserved\": \"2026-02-11T21:25:18.920Z\", \"assignerOrgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"datePublished\": \"2026-09-16T08:48:53.473Z\", \"assignerShortName\": \"Arista\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.