Security Advisory 0168

Description

On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability. Examples of sensitive information include: - Sensitive CLI commands (e.g., "username bob secret myPass") - Sensitive OpenConfig YANG leafs (e.g., "system/aaa/global/tacacs/config/secret-key") This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Scores

EPSS (exploitation in 30 days)

0.26% · top 82% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.

Weakness

• CWE-256 Plaintext Storage of a Password (opens in a new tab)All about CWE-256 and its CVEs

Affected products

• Arista Networks · EOS

  • affected 4.36.0F – ≤ 4.36.1F
  • affected 4.35.0F – < 4.36.0F
  • affected 4.34.0F – < 4.35.0F
  • affected 4.33.0F – < 4.34.0F
  • affected < 4.33.0F

What to do

Solution: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. CVE-2026-2380 has been fixed in the following releases: - 4.36.2F and later releases in the 4.36.x train No hotfix is available for this issue.

Workaround: The vulnerability can be mitigated by avoiding the transmission of requests containing sensitive information over gNMI, RESTCONF, or NETCONF. Additionally, debug tracing for the OpenConfig or Octa agents should not be enabled, i.e., do not configure "trace OpenConfig setting */*" or "trace Octa setting */*"; please note that this can only avoid sensitive information showing in the debug traces, but can not mitigate the issue cause by other configurations mentioned in the Required Configuration for Exploitation section. Should it be determined that sensitive information has been logged, the affected log files must be truncated and any compromised secrets rotated to prevent unauthorized credential usage. Use the following commands to clean up OpenConfig and Octa log files: switch(config)# bash sudo truncate -s 0 /var/log/agents/OpenConfig* switch(config)# bash sudo truncate -s 0 /var/log/agents/Octa* Then use the following commands to clean up previously rotated old log files: switch(config)# bash sudo find /var/log/agents -name 'OpenConfig*.gz' -type f -delete switch(config)# bash sudo find /var/log/agents -name 'Octa*.gz' -type f -delete

References (1)

• Security Advisory 0168 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-2380](https://trackcve.app/badge/CVE-2026-2380.svg)](https://trackcve.app/cve/CVE-2026-2380)

Record last updated 16 Sept 2026, 14:07 UTC.