EOS · CVE-2026-121371 · Infrastructure
FIX → 4.37.0F +4 ✓ verified
Arista Security Advisory 0218 (CWE-22 path traversal, CVSS 4.0: 8.7). On affected EOS with eAPI running and default-services enabled (both the default config), a crafted HTTP request lets an unauthenticated remote attacker read arbitrary files, including credentials. Found internally; Arista is not aware of malicious exploitation. No hotfix. Arista's mitigation: run 'no default-services' under 'management http-server' and under 'management api http-commands'; this removes the eAPI explorer web UI and TapAgg GUI.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any Arista switch, CloudEOS, cEOS-lab, vEOS-lab or CloudVision eXchange running an affected EOS release with eAPI running and default-services on, which is the default. DMF deployments are affected only on EOS-based fabric switches; Switch Light OS switches and DMF controller appliances are not. Teams can skip it if eAPI is off, default-services are disabled, or EOS is on a fixed release.
Not affected if cloudvision-portal, default-services-disabled, dmf-controller, eapi-disabled, fixed-version, unaffected-eos-version, wifi-access-points
Who cares arista, eapi, eos, network-gear, self-hosted, switch, unauthenticated
show management api http-commands and confirm Enabled: Yes. 3) Run and ; a line (not ) means vulnerableOn affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
show running-config all | sect http-servershow running-config all | sect http-commandsdefault-servicesno default-servicesshow version details to see the bundled EOS; Switch Light OS switches are not affectedUpgrade to 4.37.0F +4
4.36.3.2M, 4.35.7.2M, 4.34.9.2M, or 4.33.11.2M (or later in the same train)no default-services under management http-server and management api http-commands