{"id":"CVE-2026-121371","kind":"vulnerability","aliases":["CVE-2026-121371"],"related":[],"title":"Arista EOS: crafted HTTP request to eAPI reads arbitrary files without login, including credentials","description":"On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem.","summary":"Arista Security Advisory 0218 (CWE-22 path traversal, CVSS 4.0: 8.7). On affected EOS with eAPI running and default-services enabled (both the default config), a crafted HTTP request lets an unauthenticated remote attacker read arbitrary files, including credentials. Found internally; Arista is not aware of malicious exploitation. No hotfix. Arista's mitigation: run 'no default-services' under 'management http-server' and under 'management api http-commands'; this removes the eAPI explorer web UI and TapAgg GUI.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EOS","fixed":["4.37.0F","4.36.3.2M","4.35.7.2M","4.34.9.2M","4.33.11.2M"],"affected":"<= 4.36.3M (4.36.x), <= 4.35.7M (4.35.x), <= 4.34.9M (4.34.x), <= 4.33.11M (4.33.x), all 4.32.x and end-of-support trains","ecosystem":"vendor"}],"ecosystems":[],"tags":["arista","eapi","eos","infrastructure","network-gear","self-hosted","switch","unauthenticated"],"not_affected_if":["cloudvision-portal","default-services-disabled","dmf-controller","eapi-disabled","fixed-version","unaffected-eos-version","wifi-access-points"],"how_to_check":"1) Compare EOS version (show version) to affected: 4.36.3M and earlier, 4.35.7M and earlier, 4.34.9M and earlier, 4.33.11M and earlier, all 4.32.x, and all end-of-support trains. 2) Run 'show management api http-commands' and confirm 'Enabled: Yes'. 3) Run 'show running-config all | sect http-server' and 'show running-config all | sect http-commands'; a 'default-services' line (not 'no default-services') means vulnerable. Exposed only if eAPI is running AND default-services is on. IoC: review /var/log/nginx-access.log for requests with unexpected paths to static resources. DMF: on controller run 'show version details' to see the bundled EOS; Switch Light OS switches are not affected.","fix":"Upgrade to 4.37.0F or later, 4.36.3.2M, 4.35.7.2M, 4.34.9.2M, or 4.33.11.2M (or later in the same train). No hotfix. 4.32.x and end-of-support trains have no listed fix: move to a fixed train. Interim mitigation: 'no default-services' under 'management http-server' and 'management api http-commands'.","status":"open","published_at":"2026-11-10T20:18:56+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","triaged_at":"2026-11-10T20:47:26+00:00","updated_at":"2026-11-10T20:54:42+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-10T20:47:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Arista EOS: crafted HTTP request reads arbitrary switch files without login","impact":"high","summary":"On affected Arista EOS versions with the eAPI service enabled, a specially crafted HTTP request lets an unauthenticated remote attacker read arbitrary files. The files include sensitive credentials stored on the switch filesystem.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["arista","eos","network-gear","eapi"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker reads switch files, including stored credentials","analyst_note":"Find the Arista security advisory for CVE-2026-121371 to list affected and fixed EOS versions and the eAPI mitigation.","how_to_check":"- Check whether the eAPI service is enabled on the switch, for example with `show management api http-commands` (unknown if the sources give no command)\n- Compare the running EOS version with the affected ranges in the vendor advisory (unknown: the sources do not list versions)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["eapi-disabled","unaffected-eos-version"],"who_is_affected":"Only switches running an affected EOS version with the eAPI service enabled are exposed, and the flaw is reachable over HTTP. The sources do not list affected versions or the fixed release. Teams that run no Arista switches, or that keep eAPI disabled, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4522,"output_tokens":561,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Arista security advisory for CVE-2026-121371 to list affected and fixed EOS versions and the eAPI mitigation.","search":"'-121371':17A,20A '-2026':16A,19A '-22':39B '0218':37B '4.0':43B '8.7':44B 'advisori':36B 'affect':46B,116C 'allow':130C 'api':101B 'arbitrari':9A,70B,137C 'arista':1A,22B,34B,76B,85B 'attack':68B,134C 'awar':79B 'command':104B 'config':59B 'craft':3A,61B,126C 'credenti':14A,73B,141C 'cve':15A,18A 'cvss':42B 'cwe':38B 'default':53B,58B,91B 'default-servic':52B,90B 'eapi':7A,23B,49B,108B,121C 'enabl':55B,123C 'eo':2A,24B,47B,117C 'eos':21A 'exploit':82B 'explor':109B 'file':10A,71B,138C 'filesystem':145C 'found':74B 'gear':28B 'gui':114B 'host':31B 'hotfix':84B 'http':4A,62B,96B,103B,127C 'http-command':102B 'http-server':95B 'includ':13A,72B,139C 'infrastructur':25B 'intern':75B 'let':64B 'login':12A 'malici':81B 'manag':94B,100B 'mitig':87B 'network':27B 'network-gear':26B 'path':40B 'read':8A,69B,136C 'remot':67B,133C 'remov':106B 'request':5A,63B,128C 'run':50B,88B 'secur':35B 'self':30B 'self-host':29B 'sensit':140C 'server':97B 'servic':54B,92B,122C 'special':125C 'switch':32B,144C 'tapagg':113B 'travers':41B 'ui':111B 'unauthent':33B,66B,132C 'version':118C 'web':110B 'without':11A","nicknames":[],"mitigations":[],"who_affected":"Any Arista switch, CloudEOS, cEOS-lab, vEOS-lab or CloudVision eXchange running an affected EOS release with eAPI running and default-services on, which is the default. DMF deployments are affected only on EOS-based fabric switches; Switch Light OS switches and DMF controller appliances are not. Teams can skip it if eAPI is off, default-services are disabled, or EOS is on a fixed release.","tier":"B","verified":{"fix":{"at":"2026-11-10T20:54:42Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218","run_id":2724},"products":{"at":"2026-11-10T20:54:42Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218","run_id":2724},"how_to_check":{"at":"2026-11-10T20:54:42Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218","run_id":2724},"who_affected":{"at":"2026-11-10T20:54:42Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218","run_id":2724}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["eos"],"ptokens":["eos"],"labels":["arista","eapi","eos","high","infrastructure","networkgear","selfhosted","switch","unauthenticated"],"campaign_type":null,"search_a":"'-121371':17A,20A '-2026':16A,19A 'arbitrari':9A 'arista':1A 'craft':3A 'credenti':14A 'cve':15A,18A 'eapi':7A 'eo':2A 'eos':21A 'file':10A 'http':4A 'includ':13A 'login':12A 'read':8A 'request':5A 'without':11A","search_b":"'-22':39B '0218':37B '4.0':43B '8.7':44B 'advisori':36B 'affect':46B 'api':101B 'arbitrari':70B 'arista':22B,34B,76B,85B 'attack':68B 'awar':79B 'command':104B 'config':59B 'craft':61B 'credenti':73B 'cvss':42B 'cwe':38B 'default':53B,58B,91B 'default-servic':52B,90B 'eapi':23B,49B,108B 'enabl':55B 'eo':24B,47B 'exploit':82B 'explor':109B 'file':71B 'found':74B 'gear':28B 'gui':114B 'host':31B 'hotfix':84B 'http':62B,96B,103B 'http-command':102B 'http-server':95B 'includ':72B 'infrastructur':25B 'intern':75B 'let':64B 'malici':81B 'manag':94B,100B 'mitig':87B 'network':27B 'network-gear':26B 'path':40B 'read':69B 'remot':67B 'remov':106B 'request':63B 'run':50B,88B 'secur':35B 'self':30B 'self-host':29B 'server':97B 'servic':54B,92B 'switch':32B 'tapagg':113B 'travers':41B 'ui':111B 'unauthent':33B,66B 'web':110B","search_c":"'affect':116C 'allow':130C 'arbitrari':137C 'attack':134C 'craft':126C 'credenti':141C 'eapi':121C 'enabl':123C 'eo':117C 'file':138C 'filesystem':145C 'http':127C 'includ':139C 'read':136C 'remot':133C 'request':128C 'sensit':140C 'servic':122C 'special':125C 'switch':144C 'unauthent':132C 'version':118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121371","severity":null,"published_at":"2026-11-10T20:18:56+00:00","modified_at":"2026-11-10T20:18:56+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","fetched_at":"2026-11-10T20:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121371:2724","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218","severity":null,"published_at":"2026-11-10T20:54:42+00:00","modified_at":"2026-11-10T20:54:42+00:00","first_seen_at":"2026-11-10T20:54:42+00:00","fetched_at":"2026-11-10T20:54:42+00:00","note":"Read Arista SA 0218 (primary): affected/fixed versions, check commands, mitigation. Arista not aware of exploitation; found internally; no PoC seen. No hotfix. write has no mitigations flag, so mitigation is in summary/fix.","cites":["https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218"]}],"documents":[{"id":118326,"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218","title":"Arista Security Advisory 0218 (CVE-2026-121371)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}