CVE-2026-101150

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101150", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-09-28T08:30:31.034Z", "datePublished": "2026-10-06T19:37:25.747Z", "dateUpdated": "2026-10-06T19:50:49.110Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-10-06T19:37:25.747Z"}, "title": "Security Advisory 0186", "descriptions": [{"lang": "en", "value": "Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.</p>"}]}], "affected": [{"vendor": "Arista Networks", "product": "CloudVision Portal", "platforms": ["CloudVision Portal, virtual appliance or physical appliance"], "defaultStatus": "unaffected", "versions": [{"version": "2026.2.0", "status": "affected", "versionType": "custom"}, {"version": "2026.1.0", "lessThanOrEqual": "2026.1.2", "status": "affected", "versionType": "custom"}, {"version": "2025.3.0", "lessThanOrEqual": "2025.3.3", "status": "affected", "versionType": "custom"}, {"version": "2023.3.0", "lessThan": "2025.3.0", "status": "affected", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "baseScore": 4.1, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N", "baseScore": 5.1, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server-Side Request Forgery"}]}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to CVE-2026-101150, OAuth SSO must be configured and Allow Bearer Token Login must be enabled in cluster management settings. To verify, navigate to General Settings \u2192 Cluster Management. If the \"Allow Bearer Token Login\" toggle is disabled, there is no exposure to this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In order to be vulnerable to CVE-2026-101150, OAuth SSO must be configured and <strong>Allow Bearer Token Login</strong> must be enabled in cluster management settings. To verify, navigate to <strong>General Settings \u2192 Cluster Management</strong>. If the <em>Allow Bearer Token Login</em> toggle is disabled, there is no exposure to this issue.</p>"}]}], "workarounds": [{"lang": "en", "value": "There is no configuration-based mitigation for this issue. However, operators can consider switching to an alternative non-OIDC SSO login method, if feasible. Additionally, restrict AAA settings and Account Management configuration permissions to trusted personnel only.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>There is no configuration-based mitigation for this issue. However, operators can consider switching to an alternative non-OIDC SSO login method, if feasible. Additionally, restrict AAA settings and Account Management configuration permissions to trusted personnel only.</p>"}]}], "solutions": [{"lang": "en", "value": "CVE-2026-101150 has been fixed in the following releases:\n- 2026.2.1 and later releases in the 2026.2.x train\n- 2026.1.3 and later releases in the 2026.1.x train\n- 2025.3.4 and later releases in the 2025.3.x train", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>CVE-2026-101150 has been fixed in the following releases:</p><ul><li>2026.2.1 and later releases in the 2026.2.x train</li><li>2026.1.3 and later releases in the 2026.1.x train</li><li>2025.3.4 and later releases in the 2025.3.x train</li></ul>"}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24802-security-advisory-0186", "tags": ["vendor-advisory"]}], "source": {"advisory": "Security Advisory 0186", "discovery": "INTERNAL", "defects": ["BUG 1919438"]}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T19:50:37.698532Z", "id": "CVE-2026-101150", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T19:50:49.110Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-101150", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T19:50:37.698532Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T19:50:43.912Z"}}], "cna": {"title": "Security Advisory 0186", "source": {"defects": ["BUG 1919438"], "advisory": "Security Advisory 0186", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server-Side Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 4.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Arista Networks", "product": "CloudVision Portal", "versions": [{"status": "affected", "version": "2026.2.0", "versionType": "custom"}, {"status": "affected", "version": "2026.1.0", "versionType": "custom", "lessThanOrEqual": "2026.1.2"}, {"status": "affected", "version": "2025.3.0", "versionType": "custom", "lessThanOrEqual": "2025.3.3"}, {"status": "affected", "version": "2023.3.0", "lessThan": "2025.3.0", "versionType": "custom"}], "platforms": ["CloudVision Portal, virtual appliance or physical appliance"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "CVE-2026-101150 has been fixed in the following releases:\n- 2026.2.1 and later releases in the 2026.2.x train\n- 2026.1.3 and later releases in the 2026.1.x train\n- 2025.3.4 and later releases in the 2025.3.x train", "supportingMedia": [{"type": "text/html", "value": "<p>CVE-2026-101150 has been fixed in the following releases:</p><ul><li>2026.2.1 and later releases in the 2026.2.x train</li><li>2026.1.3 and later releases in the 2026.1.x train</li><li>2025.3.4 and later releases in the 2025.3.x train</li></ul>", "base64": false}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24802-security-advisory-0186", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "There is no configuration-based mitigation for this issue. However, operators can consider switching to an alternative non-OIDC SSO login method, if feasible. Additionally, restrict AAA settings and Account Management configuration permissions to trusted personnel only.", "supportingMedia": [{"type": "text/html", "value": "<p>There is no configuration-based mitigation for this issue. However, operators can consider switching to an alternative non-OIDC SSO login method, if feasible. Additionally, restrict AAA settings and Account Management configuration permissions to trusted personnel only.</p>", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.", "supportingMedia": [{"type": "text/html", "value": "<p>Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to CVE-2026-101150, OAuth SSO must be configured and Allow Bearer Token Login must be enabled in cluster management settings. To verify, navigate to General Settings \u2192 Cluster Management. If the \"Allow Bearer Token Login\" toggle is disabled, there is no exposure to this issue.", "supportingMedia": [{"type": "text/html", "value": "<p>In order to be vulnerable to CVE-2026-101150, OAuth SSO must be configured and <strong>Allow Bearer Token Login</strong> must be enabled in cluster management settings. To verify, navigate to <strong>General Settings \u2192 Cluster Management</strong>. If the <em>Allow Bearer Token Login</em> toggle is disabled, there is no exposure to this issue.</p>", "base64": false}]}], "providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-10-06T19:37:25.747Z"}}}, "cveMetadata": {"cveId": "CVE-2026-101150", "state": "PUBLISHED", "dateUpdated": "2026-10-06T19:50:49.110Z", "dateReserved": "2026-09-28T08:30:31.034Z", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "datePublished": "2026-10-06T19:37:25.747Z", "assignerShortName": "Arista"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["CloudVision Portal, virtual appliance or physical appliance"], "product": "CloudVision Portal", "vendor": "Arista Networks", "versions": [{"status": "affected", "version": "2026.2.0", "versionType": "custom"}, {"lessThanOrEqual": "2026.1.2", "status": "affected", "version": "2026.1.0", "versionType": "custom"}, {"lessThanOrEqual": "2025.3.3", "status": "affected", "version": "2025.3.0", "versionType": "custom"}, {"lessThan": "2025.3.0", "status": "affected", "version": "2023.3.0", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations."}], "id": "CVE-2026-101150", "lastModified": "2026-10-07T13:38:48.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 1.4, "source": "psirt@arista.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@arista.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-101150", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-06T19:50:37.698532Z", "version": "2.0.3"}}]}, "published": "2026-10-06T20:17:08.937", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24802-security-advisory-0186"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["cloudvision_portal,_virtual_appliance_or_physical_appliance"], "status": "affected", "versions": {"scheme": "semver", "value": "2026.2.0"}}, {"platform": ["cloudvision_portal,_virtual_appliance_or_physical_appliance"], "status": "affected", "versions": {"scheme": "semver", "value": "[2026.1.0,2026.1.2]"}}, {"platform": ["cloudvision_portal,_virtual_appliance_or_physical_appliance"], "status": "affected", "versions": {"scheme": "semver", "value": "[2025.3.0,2025.3.3]"}}, {"platform": ["cloudvision_portal,_virtual_appliance_or_physical_appliance"], "status": "affected", "versions": {"scheme": "semver", "value": "[2023.3.0,2025.3.0)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "CloudVision Portal", "source": "cna", "vendor": "Arista Networks"}, "product": "cloudvision_portal", "vendor": "arista"}], "created": "2026-10-06T20:30:05.838301+00:00", "title": "Insufficient validation of OIDC bearer token configuration allows high\u2011privilege redirection", "updated": "2026-10-09T07:45:18.061339+00:00", "vendors": ["arista", "arista$PRODUCT$cloudvision_portal"]}