CVE-2026-73439

Name of the Vulnerable Software and Affected Versions Arista EOS (affected versions not specified)

Description When OpenConfig is configured with a running gNMI server and gNSI Pathz is active with a defined policy, gNMI may fail to correctly enforce policy rules if both a group rule and a user rule exist for the same path. This flaw allows an authenticated user to obtain unauthorized read or write permissions for gNMI paths that the Pathz policy is designed to restrict.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.