CVE-2026-2380

Executive Summary

CVE-2026-2380 is an information disclosure vulnerability affecting Arista EOS platforms that expose OpenConfig-related management services (gNMI, gNSI, RESTCONF, and NETCONF). Because these services may unintentionally log sensitive request and response payloads, credentials and secrets such as CLI secrets and AAA TACACS secret-key YANG leaves can be written to local device logs or forwarded to remote accounting servers. With a CVSS base score of 7.4 and a Scope:Changed vector, the flaw allows a low-privileged, network-reachable actor to obtain sensitive material that can widen the compromise across trust boundaries — though Arista states no malicious exploitation has been observed to date.

Technical Analysis

The vulnerability is classified as CWE-256 (Plaintext Storage of a Password) and stems from how Arista EOS handles logging for OpenConfig-related services. Per the NVD description, "sensitive requests and responses may be unintentionally logged" when OpenConfig services are in use. This means the logging subsystem captures the content of management requests and responses without redacting secret-bearing fields.

The relevant attack surface comprises four protocols/services on EOS:

• gNMI — gRPC Network Management Interface
• gNSI — gRPC Network State Interface
• RESTCONF — HTTP-based OpenConfig/REST management
• NETCONF — XML-based network configuration protocol

The description explicitly notes that "gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected." This scoping statement is important: the exposure is tied to request/response handling in the affected OpenConfig management paths, not to the streaming telemetry data path.

Two categories of sensitive data are called out verbatim by the vendor:

1. Sensitive CLI commands — the example given is username bob secret myPass, indicating that cleartext or recoverable credentials passed through the affected services can land in logs.
2. Sensitive OpenConfig YANG leafs — the example is system/aaa/global/tacacs/config/secret-key, a AAA TACACS shared secret.

Once logged, the data "may be stored on the local EOS device or recorded on remote accounting servers." Local storage broadens the blast radius because any party with read access to local logs (or a subsequent weakness in log handling) can recover the secrets. Remote accounting servers introduce a second exfiltration surface and a lateral trust boundary.

The CVSS subscores (C:L / I:L / A:L, S:C) are consistent with partial, non-destructive disclosure that nonetheless crosses a security scope boundary — credentials harvested from device logs can be reused to authenticate to the device or to upstream AAA infrastructure, elevating the effective impact beyond the immediate host. The CWE-256 mapping reinforces that the core defect is storing secrets in a form (log text) that does not adequately protect them.

No affected version range, fixed version, or patch reference was present in the provided intelligence. No public proof-of-concept, Nuclei template, or exploit code exists per the supplied data. The EPSS score has not been published by FIRST.org, and this CVE is not listed in CISA KEV. It is therefore not accurate to assign an exploitation-likelihood figure.

Technical detail on the exact logging pipeline, redaction configuration, or the precise code path that fails to filter secrets is not available in the supplied description. Those specifics should not be inferred.

Exploitation Scenarios

No public PoC exists for CVE-2026-2380; the attack chain below is inferred from the vulnerability class (CWE-256, cleartext/insufficiently-protected secret storage via unintended logging) and the vendor's own description. It does not rely on invented function names, endpoints, or parameters.

1) Reconnaissance / target identification. An adversary first identifies reachable Arista EOS devices exposing OpenConfig management services. Candidate services are gNMI, gNSI, RESTCONF, and NETCONF, which typically listen on well-known management ports (for example, NETCONF on TCP/830). An attacker with any level of legitimate network access — or a misconfigured exposure — enumerates management endpoints to confirm which OpenConfig services are active on the target.

2) Triggering the flaw class. The defect is triggered by legitimate management operations that carry sensitive fields. Because EOS "may unintentionally log" these requests and responses, the attacker does not need a malformed payload: any request or response containing a sensitive CLI command or a sensitive YANG leaf (such as a TACACS secret-key) can be captured in the log stream. The vulnerability is therefore passive with respect to the trigger — the sensitive content is written when the affected service processes the request/response.

3) Payload / execution at the vulnerability-class level. There is no memory-corruption or code-execution payload. Instead, the "exploit" is the act of causing secrets to be committed to a log destination and then obtaining that destination. Sensitive material is written either to local EOS storage or forwarded to a remote accounting server. An actor with read access to those logs — via device log access, a logging pipeline, or a downstream accounting/collector system — reads the exposed content (for example, a CLI secret, or the AAA TACACS secret-key).

4) Post-exploitation impact. Harvested secrets enable credential reuse. A captured device secret can authenticate to the EOS device itself; a captured TACACS secret-key can support integrity/authentication abuse against AAA infrastructure or enable further credential compromise. Because the CVSS scope is Changed (S:C), the value harvested on one device can affect systems and trust boundaries beyond that device. The attacker gains confidentiality of secrets (C:L) and, through reuse, can achieve limited integrity and availability effects (I:L, A:L).

Note: The above is a vulnerability-class description. No specific file paths, logging function names, or API parameters are asserted because none were provided.

Impact Assessment

Affected systems. Arista EOS platforms running any of the OpenConfig-related services named by the vendor (gNMI, gNSI, RESTCONF, NETCONF). The gRPC streaming telemetry path to CloudVision is explicitly excluded.

Impact. Sensitive credentials and secrets may be persistently written to local device storage or remote accounting servers. This is a confidentiality-primarily event (C:L) with secondary integrity and availability consequences (I:L, A:L) arising from credential reuse, which is why the CVSS scope is Changed (S:C) and the base score reaches 7.4.

Blast radius. Two tiers: (a) the individual EOS device whose logs store the secrets, and (b) any remote accounting server or log aggregation system that receives forwarded records, plus any system reachable using the harvested credentials (e.g., AAA/TACACS infrastructure). Log retention practices materially expand the window of exposure.

Severity calibration. The vector AV:N/AC:L/PR:L/UI:N indicates network-reachable exploitation requiring low privileges and no user interaction, which lowers the operational bar for a positioned attacker. The lack of a public exploit and the absence of KEV listing mean there is no evidence of active exploitation, but the high base score and scope change argue for treating this as a high-priority hygiene issue for affected fleets.

Detection Guidance

Sigma Rule

title: Potential Arista EOS OpenConfig Sensitive Data Logging (CVE-2026-2380)
id: 3b0f9a72-0f2c-4a2e-9c11-arista2380
status: experimental
description: Detects access or retrieval of EOS log files/logging destinations that may contain OpenConfig secrets exposed per CVE-2026-2380
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-2380
author: valtersit.com
logsource:
  product: arista_eos
  service: syslog
detection:
  keywords:
    - 'username '
    - ' secret '
  context:
    - 'gnmi'
    - 'gnsi'
    - 'restconf'
    - 'netconf'
    - 'openconfig'
    - 'system/aaa/global/tacacs/config/secret-key'
  condition: keywords and context
falsepositives:
  - Legitimate administrative configuration review
level: high
tags:
  - attack.t1552
  - cve.2026.2380

YARA Rule

rule CVE_2026_2380_Arista_EOS_SecretInLogs
{
    meta:
        description = "Detects Arista EOS log artifacts that may contain OpenConfig secrets per CVE-2026-2380"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-2380"
        date = "2026-01-01"
    strings:
        $yang = "system/aaa/global/tacacs/config/secret-key"
        $cli  = "username bob secret"
        $svc1 = "gnmi"
        $svc2 = "netconf"
        $svc3 = "restconf"
        $svc4 = "gnsi"
    condition:
        ($yang or $cli) or
        (2 of ($svc*))
}

Suricata IDS Rule

alert tcp any any -> any 830 (msg:"CVE-2026-2380 Arista EOS OpenConfig secret exposure NETCONF"; flow:to_server,established; content:"secret-key"; nocase; content:"tacacs"; nocase; classtype:policy-violation; sid:20262380; rev:1;)

Elastic Detection

sequence by host.name
  [process where event.type == "start" and process.args : ("show logging*", "*log*")]
  [file where file.path : "*" and event.action == "read" and
     file.name : ("*log*","*messages*")]

Splunk SPL Query

index=arista sourcetype="arista:eos"
| search ("system/aaa/global/tacacs/config/secret-key" OR "secret " OR "username ")
| search ("gnmi" OR "gnsi" OR "restconf" OR "netconf" OR "openconfig")
| stats count min(_time) as first_seen max(_time) as last_seen by host, source
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="arista,eos,cve-2026-2380,">
  <rule id="2026238" level="12">
    <decoded_as>syslog</decoded_as>
    <match>system/aaa/global/tacacs/config/secret-key|username .* secret</match>
    <description>CVE-2026-2380: Possible sensitive secret logged by Arista EOS OpenConfig service</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was found in any tracked source, no vendor fix version was provided, and no workarounds were supplied. The guidance below is therefore precautionary and must be validated against an official Arista advisory before production use.

1) Immediate mitigations

• Restrict network reachability to gNMI, gNSI, RESTCONF, and NETCONF management interfaces (segment management plane, apply ACLs, disable unused services).
• Reduce log verbosity and review logging configuration to prevent management request/response bodies from being retained. Where redaction controls exist, verify they cover the sensitive fields the vendor named (CLI secrets and AAA TACACS secret-key).
• Harden log destinations: restrict read access to local EOS logs and remote accounting servers on a least-privilege basis.
• Monitor for and rotate any secrets that may have already been exposed in existing logs (device secrets, TACACS shared secrets).

2) Patch / upgrade steps

• Consult the Arista security advisory portal and EOS release notes for a fixed release addressing CVE-2026-2380; no fixed version was provided in this dataset.
• Until a patch is confirmed, treat affected devices as exposure-prone and prioritize detection and credential rotation.

3) Long-term hardening

• Apply a secrets-management policy that assumes management-plane logs may leak; avoid cleartext secret entry where possible.
• Enable and validate redaction for all OpenConfig management logging.
• Adopt centralized, access-controlled log retention with short retention for request/response payloads.
• Track CVE-2026-2380 for an official patch and re-run patch confidence assessment once a fixed version is published; confirm whether CISA KEV status changes.

References

• NVD — CVE-2026-2380: https://nvd.nist.gov/vuln/detail/CVE-2026-2380
• Arista Security Advisories / Security Portal: https://www.arista.com/en/support/advisories-notices
• CWE-256 — Plaintext Storage of a Password: https://cwe.mitre.org/data/definitions/256.html
• MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• FIRST EPSS (score not yet published for this CVE): https://www.first.org/epss/

Threat actor / exploitation status: Per the vendor, the issue was discovered internally by Arista, and the company is not aware of any malicious exploitation in customer networks. No public proof-of-concept, exploit code, or Nuclei template was identified. CVE-2026-2380 is not listed in CISA KEV. No threat actor campaigns are associated with this CVE in the supplied data.