CVE-2026-101152

Executive Summary

CVE-2026-101152 is an insufficient input-validation vulnerability in the Single Sign-On (SSO) login flow of CloudVision that permits a remote, unauthenticated attacker to craft a URL which, when clicked by a victim, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled destination rather than to CloudVision. The flaw is classified as CWE-601 (URL Redirection to Untrusted Site, i.e., open redirect) and carries a CVSS 3.1 base score of 8.0 (High), driven by the scope change and High confidentiality and integrity impact despite the requirement for user interaction. Because successful exploitation yields authentication material, any CloudVision deployment that delegates login to an external IdP — and any user who can be induced to click a crafted link — is a candidate target. No public PoC, exploit code, or Nuclei template exists as of this report, and no patch is currently available.

Technical Analysis

The vulnerability resides in the SSO login flow of CloudVision. The NVD description states that "insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision."

The CWE classification, CWE-601 (URL Redirection to Untrusted Site), confirms the mechanism at the vulnerability-class level: the SSO flow fails to adequately validate a URL parameter or redirect target, and as a result the IdP posts or redirects authentication material to a destination that is not the legitimate CloudVision endpoint. In the standard SAML/OIDC SSO model, the IdP is trusted to deliver an authentication assertion, authorization code, or token to the Service Provider callback URL that was registered and validated in advance. When the Service Provider (CloudVision) does not sufficiently validate the redirect/callback destination in its login flow, an attacker can supply a crafted URL such that the IdP directs that authentication material to an attacker-controlled URL.

The following points are directly supported by the source description and CWE mapping:

• Attack surface: the SSO login flow of CloudVision, specifically the handling of a URL within the authentication request or callback path. No specific parameter name, endpoint, or file path is provided in the source data, so none is asserted here.
• Validation gap: "insufficient validation" of the URL. The precise validation routine is not described in the source data and is not speculated upon.
• Delivery target: the IdP, being a distinct identity domain, is induced to send "authentication material" — the class of tokens/assertions that SSO typically returns — to an attacker-controlled URL. The exact artifact type (SAML assertion, OIDC authorization code, etc.) is not specified in the source data.
• Scope change (S): the CVSS vector's S:C reflects that exploitation impacts resources beyond the vulnerable CloudVision component, consistent with the IdP being cross-origin and a separate security authority.
• Complexity (AC:H): exploitation is not trivial to automate — the CVSS vector rates attack complexity High, consistent with the need to arrange a valid IdP interaction and target a specific, reachable redirect path. Privileges (PR:N): no authentication is required of the attacker. UI:R: the victim must click the crafted URL.

The vulnerability does not, per the available description, involve memory corruption, injection, or remote code execution. Its impact is the misdirection of authentication material, which in turn enables session/identity compromise rather than direct host takeover.

Because no CNA title, affected version range, CVE record ID metadata, or vendor advisory is provided, this report deliberately omits implementation detail — function names, parameter names, endpoint paths, and the specific token type — as these are not derivable from the supplied intelligence. Analysis is therefore constrained to the vulnerability class (open redirect / SSO validation bypass) and its generic attack mechanism.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-601) and the NVD description narrative, without inventing implementation specifics.

1) Reconnaissance / target identification. The attacker identifies or assumes a target organization that uses CloudVision with a federated SSO IdP. Because exploitation is network-reachable (AV:N) and unauthenticated (PR:N), no prior access to CloudVision is required; the attacker only needs to know that SSO is enabled and the general login-flow entry point. This information is commonly available from a reachable login page or publicly known deployment patterns; no specific endpoint is asserted here.

2) Triggering the flaw. The attacker crafts a URL that manipulates the destination to which the IdP delivers authentication material — the "URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision." The exact construction depends on the unvalidated parameter in the login flow, which is not disclosed in the source data; at the vulnerability-class level, this is a URL-redirection/validation bypass in the SSO request. Meeting the High attack-complexity rating, the attacker may need to align the crafted link with a valid IdP session or a specific callback path.

3) Delivery / user action (UI:R). The crafted URL is delivered to a victim — for example, via phishing (T1566) or a crafted link on a resource the victim trusts. The vulnerability requires the user to click the link. Requiring user interaction is reflected in the CVSS vector (UI:R) and lowers the ease of mass exploitation compared with an unauth-remote, no-interaction bug.

4) Authentication-material capture and post-exploitation impact. When the victim clicks the link, the IdP — which trusts the request — delivers the authentication material to the attacker-controlled URL instead of CloudVision. The attacker thereby obtains authentication material (confidentiality High, C:H). Depending on the token type and lifetime, the attacker may be able to replay or otherwise leverage that material to gain the victim's authenticated context, enabling unauthorized access and manipulation of CloudVision resources (integrity High, I:H). Because the IdP and CloudVision are separate authorities, the impact reaches beyond the vulnerable component (S:C). Availability impact is rated None (A:N) in the supplied vector, so denial of service is not an expected outcome of exploitation.

Note: the source data does not state the token/assertion type, lifetime, or whether direct replay into CloudVision is possible; any such specifics are not asserted here.

Impact Assessment

• Business impact: If exploitation succeeds, the attacker may obtain authentication material and leverage it to act within the victim's CloudVision context, exposing the confidentiality and integrity of managed network/cloud infrastructure under CloudVision's control. Given CloudVision's role as a management plane, compromise of an authenticated operator session can translate into downstream configuration or visibility into production network estates. The source data does not establish the exact token semantics, so the precise reachability of downstream actions is not asserted.
• Affected systems: CloudVision deployments that use an external SSO IdP for login. No specific version range is provided; the blast radius in terms of version coverage is therefore undetermined from the source data.
• CVSS 3.1 subscores (score 8.0, High):
  • AV:N — reachable over the network.
  • AC:H — attack complexity High (exploitation conditions are constrained).
  • PR:N — no privileges required.
  • UI:R — requires user interaction (victim must click the crafted URL).
  • S:C — scope change; impact extends to the IdP/beyond the vulnerable component.
  • C:H / I:H — high confidentiality and integrity impact via capture/use of authentication material.
  • A:N — no availability impact.
• Blast radius considerations: the primary blast radius is the set of users who can be induced to click a crafted link and whose SSO sessions carry meaningful privileges; the same crafted-URL technique can be retargeted at other users, but each successful compromise requires a user click (UI:R).
• Exploitation status: CISA KEV: NO. PoC/exploit: None. Nuclei template: NO. There is no evidence in the supplied data of in-the-wild exploitation or threat-actor campaigns. EPSS has not yet been scored by FIRST.org (reminder: no EPSS value should be assumed).

Detection Guidance

Detection focuses on the SSO/redirect abuse class: anomalous redirect/callback parameters or destinations in authentication requests, IdP post/redirect activity toward unexpected external hosts, and unusual handling of authentication material. Because the specific vulnerable parameter is not disclosed, the rules below detect the general behavior class and should be tuned to the environment's legitimate IdP and CloudVision hosts.

Sigma Rule

title: Suspicious SSO Redirect to External Host in CloudVision Authentication Flow
id: 3f9a2c7e-5b41-4d8e-9c10-7a6e1d2f4b88
status: experimental
description: Detects authentication/SSO redirect or callback parameters pointing to external, non-allowlisted hosts, consistent with CWE-601 open redirect abuse of the SSO login flow (CVE-2026-101152).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101152
author: valtersit.com
date: 2026/01/01
logsource:
  category: web
  product: generic
detection:
  selection_redirect_param:
    cs-uri-query|contains:
      - 'redirect='
      - 'returnurl='
      - 'return_url='
      - 'callback='
      - 'redirect_uri='
      - 'RelayState='
  filter_allowlisted_hosts:
    cs-uri-query|contains:
      - 'cloudvision'
      - 'arista.com'
  condition: selection_redirect_param and not filter_allowlisted_hosts
falsepositives:
  - Legitimate SSO redirects to sanctioned identity provider or corporate domains not captured by the allowlist
level: medium
tags:
  - attack.t1566
  - cve.2026.101152

YARA Rule

rule CVE_2026_101152_SSO_Redirect_Misdirection
{
    meta:
        description = "Detects HTTP request artifacts referencing external redirect/callback targets in SSO login flows, consistent with CWE-601 open redirect in CloudVision SSO (CVE-2026-101152)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101152"
        severity = "high"

    strings:
        $p1 = "redirect_uri=" nocase
        $p2 = "returnurl=" nocase
        $p3 = "return_url=" nocase
        $p4 = "callback=" nocase
        $p5 = "RelayState=" nocase
        $sso = "sam" nocase
        $auth = "sso" nocase

    condition:
        filesize < 1MB and
        (any of ($p1, $p2, $p3, $p4, $p5)) and
        (any of ($sso, $auth))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101152 CloudVision SSO Open Redirect / Auth Material Misdirection Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"redirect_uri="; nocase; http.uri; content:"http"; nocase; reference:cve,2026-101152; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-101152; classtype:attempted-recon; sid:2026101152; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where network.protocol == "http" and
      url.query : ("*redirect_uri=*", "*return_url=*", "*returnurl=*", "*RelayState=*") and
      not url.domain : ("*.arista.com") ]
  [ network where network.protocol == "http" and
      url.query : ("*code=*", "*SAMLResponse=*", "*token=*") and
      not url.domain : ("*.arista.com") ]

Splunk SPL Query

index=web OR index=proxy
| eval q=lower(coalesce(uri_query, url, cs_uri_query, ""))
| where (match(q, "redirect_uri=") OR match(q, "return_url=") OR match(q, "returnurl=") OR match(q, "relaystate=") OR match(q, "callback="))
| where NOT (match(q, "arista\.com") OR match(q, "cloudvision"))
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as src_ips values(uri_path) as paths by host, user
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2026-101152,">
  <rule id="101152" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>redirect_uri=|return_url=|returnurl=|RelayState=|callback=</url>
    <description>CVE-2026-101152: Possible CloudVision SSO redirect/callback manipulation (CWE-601) with external destination</description>
    <mitre>
      <id>T1566</id>
    </mitre>
    <group>cve_2026_101152,sso_redirect,</group>
  </rule>
  <rule id="101153" level="12">
    <if_sid>101152</if_sid>
    <regex>https?://(?!.*(arista\.com|cloudvision))</regex>
    <description>CVE-2026-101152: SSO redirect parameter points to a non-allowlisted external host</description>
    <group>cve_2026_101152,sso_redirect,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround was provided in the source data.

1) Immediate mitigations (compensating controls, since no patch exists):

• Enforce strict allowlisting of redirect/callback destinations at the IdP and any reverse proxy in front of CloudVision: only pre-registered CloudVision callback URLs should be accepted; reject any request whose redirect/callback target is not an exact match.
• Configure the IdP to use fixed, pre-registered reply/redirect URLs and disable acceptance of IdP-initiated redirects to arbitrary destinations where the platform permits.
• Require user awareness and anti-phishing controls: because exploitation requires a click (UI:R), email/web link filtering, banner warnings on external links, and phishing-resistant MFA can reduce success.
• Monitor and, where feasible, block redirect/callback parameters pointing to external hosts in the SSO flow (see Detection Guidance).
• Reduce the value of stolen authentication material: enforce short token/session lifetimes, bind sessions to context where supported, and enable anomaly detection on authentication events.
• Restrict internet exposure of the CloudVision login surface where operationally possible, and segment management-plane access.

2) Patch/upgrade steps: No patch is available as of this report (patch confidence 0/4). Monitor the vendor's (Arista) security advisory channel and the NVD entry for CVE-2026-101152 for a fixed release; when published, apply the vendor-recommended version and re-validate the SSO callback/redirect validation. Do not assume a fixed version until the vendor confirms.

3) Long-term hardening:

• Require exact-match validation of all callback/redirect URLs in SSO integrations as a standing design principle (defense against the CWE-601 class).
• Adopt phishing-resistant authentication (e.g., FIDO2/WebAuthn) to blunt credential/authentication-material capture.
• Maintain strict IdP trust configuration, avoid wildcard redirect registrations, and audit SSO integrations periodically.
• Instrument continuous detection for anomalous SSO redirect and authentication-material flows, and include these rules in the SOC's monitoring content.
• Track CISA KEV and vendor advisories for escalation to active-exploitation status; currently KEV = NO.

References

• NVD — CVE-2026-101152: https://nvd.nist.gov/vuln/detail/CVE-2026-101152
• MITRE CWE-601 — URL Redirection to Untrusted Site ("Open Redirect"): https://cwe.mitre.org/data/definitions/601.html
• FIRST — EPSS (CVE not yet scored as of this report): https://www.first.org/epss/
• CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-101152 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• MITRE ATT&CK — T1566 Phishing: https://attack.mitre.org/techniques/T1566/
• Vendor security advisories (Arista) — consult the official advisory channel for a fixed release; no vendor advisory reference was supplied in the source data for this report.

No known threat-actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-101152 in the provided intelligence (CISA KEV: NO; PoC/exploit: None; Nuclei template: NO).