CVE-2026-101149
Received
Received - Intake
Insufficient OIDC SSO Configuration Validation in Arista EOS
Vulnerability report for CVE-2026-101149, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-06
Last updated on: 2026-10-06
Assigner: Arista Networks, Inc.
Description
Description
Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Arista | Networks | CloudVision Portal 2026.2.0 |
| Arista | Networks | CloudVision Portal 2026.1.0 |
| Arista | Networks | CloudVision Portal 2025.3.0 |
| Arista | Networks | CloudVision Portal 2020.3.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
