Arista CloudVision Portal CVE-2026-101149

Exploitation requires an account with specific HIGH privileges on Arista CloudVision Portal - specifically the ability to view and modify the OIDC SSO provider configuration - because the flaw is insufficient validation of that provider configuration (PR:H). The attacker must have network access to the CVP management interface (AV:N) but needs no user interaction (UI:N) and faces low attack complexity (AC:L). The dominant limiting factor is the high-privilege prerequisite: a low-privileged or unauthenticated attacker cannot reach the vulnerable configuration path, so realistic risk is confined to abuse by, or takeover of, already-privileged administrative accounts. Affected deployments are CloudVision Portal versions in the 2020.3.0-2025.3.3, 2026.1.0-2026.1.2, and 2026.2.0 ranges per EUVD; patched releases from Arista remove exposure.

This is a genuinely low-to-moderate priority issue despite the SSRF classification (CWE-918), and the available signals are notably consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) describes a network-reachable, low-complexity attack but one that explicitly requires HIGH privileges (PR:H) - matching the description's 'user with specific high privileges' who can alter OIDC SSO provider configuration. Impact is constrained: the vulnerable system itself sees no confidentiality/integrity/availability impact (VC:N/VI:N/VA:N), with only a LOW subsequent-system confidentiality impact (SC:L), reflecting classic SSRF where the harm is request redirection to other reachable destinations rather than direct compromise of CloudVision itself. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed exploitation), Automatable=no, Technical Impact=partial. There is no KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or opportunistic exploitation. The base score of 5.1 (Medium) is driven down by the PR:H requirement - an attacker already holding high administrative privileges is the precondition, which greatly limits real-world risk. No key signals contradict each other here; the main residual uncertainty is the exact security boundary being crossed (an already-privileged admin abusing SSO config), which should be confirmed against the Arista advisory.

An authenticated user already holding high administrative privileges on Arista CloudVision Portal modifies the OIDC SSO provider configuration to point authentication/discovery requests at an attacker-controlled or internal destination. Because validation of the provider configuration is insufficient, the server can be coerced into issuing requests to arbitrary destinations, potentially reaching internal services not otherwise exposed. No public exploit code has been identified, and exploitation requires pre-existing high privileges plus network access to the management interface.