---
id: "CVE-2026-121371"
page: "https://infrastack.ai/live/CVE-2026-121371"
kind: "vulnerability"
aliases: ["CVE-2026-121371"]
title: "Arista EOS: crafted HTTP request to eAPI reads arbitrary files without login, including credentials"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "EOS", "fixed": ["4.37.0F", "4.36.3.2M", "4.35.7.2M", "4.34.9.2M", "4.33.11.2M"], "affected": "<= 4.36.3M (4.36.x), <= 4.35.7M (4.35.x), <= 4.34.9M (4.34.x), <= 4.33.11M (4.33.x), all 4.32.x and end-of-support trains", "ecosystem": "vendor"}]
ecosystems: []
tags: ["arista", "eapi", "eos", "infrastructure", "network-gear", "self-hosted", "switch", "unauthenticated"]
not_affected_if: ["cloudvision-portal", "default-services-disabled", "dmf-controller", "eapi-disabled", "fixed-version", "unaffected-eos-version", "wifi-access-points"]
published_at: "2026-11-10T20:18:56+00:00"
first_seen_at: "2026-11-10T20:46:04+00:00"
updated_at: "2026-11-10T20:54:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121371", "first_seen_at": "2026-11-10T20:46:04+00:00"}, {"source": "analyst", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218", "first_seen_at": "2026-11-10T20:54:42+00:00", "cites": ["https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218"]}]
exploit_sources: []
---

# Arista EOS: crafted HTTP request to eAPI reads arbitrary files without login, including credentials

Link for people: https://infrastack.ai/live/CVE-2026-121371 (this .md is for agents)

Arista Security Advisory 0218 (CWE-22 path traversal, CVSS 4.0: 8.7). On affected EOS with eAPI running and default-services enabled (both the default config), a crafted HTTP request lets an unauthenticated remote attacker read arbitrary files, including credentials. Found internally; Arista is not aware of malicious exploitation. No hotfix. Arista's mitigation: run 'no default-services' under 'management http-server' and under 'management api http-commands'; this removes the eAPI explorer web UI and TapAgg GUI.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EOS affected <= 4.36.3M (4.36.x), <= 4.35.7M (4.35.x), <= 4.34.9M (4.34.x), <= 4.33.11M (4.33.x), all 4.32.x and end-of-support trains fixed 4.37.0F, 4.36.3.2M, 4.35.7.2M, 4.34.9.2M, 4.33.11.2M

## How to check

1) Compare EOS version (show version) to affected: 4.36.3M and earlier, 4.35.7M and earlier, 4.34.9M and earlier, 4.33.11M and earlier, all 4.32.x, and all end-of-support trains. 2) Run 'show management api http-commands' and confirm 'Enabled: Yes'. 3) Run 'show running-config all | sect http-server' and 'show running-config all | sect http-commands'; a 'default-services' line (not 'no default-services') means vulnerable. Exposed only if eAPI is running AND default-services is on. IoC: review /var/log/nginx-access.log for requests with unexpected paths to static resources. DMF: on controller run 'show version details' to see the bundled EOS; Switch Light OS switches are not affected.

## Fix

Upgrade to 4.37.0F or later, 4.36.3.2M, 4.35.7.2M, 4.34.9.2M, or 4.33.11.2M (or later in the same train). No hotfix. 4.32.x and end-of-support trains have no listed fix: move to a fixed train. Interim mitigation: 'no default-services' under 'management http-server' and 'management api http-commands'.

## Timeline

- 2026-11-10T20:46:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121371
- 2026-11-10T20:54:42+00:00 analyst https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218 — Read Arista SA 0218 (primary): affected/fixed versions, check commands, mitigation. Arista not aware of exploitation; found internally; no PoC seen. No hotfix. write has no mitigations flag, so mitigation is in summary/fix.

## Documents

- [advisory] Arista Security Advisory 0218 (CVE-2026-121371) https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218

## From the sources

On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_