CVE-2026-102157

Received Received - Intake

Insecure Direct Object Reference in Arista CloudVision CUE File-Serving Interface

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: Arista Networks, Inc.

Description

An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-06

Generated

2026-10-07

AI Q&A

2026-10-07

EPSS Evaluated

N/A

NVD

CVE-2026-102157

EUVD

EUVD-2026-93954

Affected Vendors & Products

Vendor	Product	Version / Range
Arista	Networks	CloudVision CUE 2021.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is an insecure direct object reference (IDOR) vulnerability in CloudVision CUE's file-serving interface. It may allow an authenticated network user to access another user's transient data under specific attack conditions.

Impact Analysis

An attacker could exploit this to view sensitive transient data belonging to other users, potentially exposing confidential information or session details.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating privacy requirements in GDPR and HIPAA, potentially resulting in compliance breaches and legal penalties.

Mitigation Strategies

Apply the latest security patches or updates from Arista Networks for CloudVision CUE to address the IDOR vulnerability. Ensure proper access controls are enforced to prevent unauthorized data access.

Hi! I’m here to help you understand CVE-2026-102157. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70