Arista CV-CUE CVE-2026-102161

Exploitation depends on CV-CUE trusting a client-supplied/source IP address to authorize administrative sessions. The concrete prerequisite is network position: the attacker must either sit on an adjacent private network segment (AV:A) with the CV-CUE backend, OR send requests through a reverse proxy/load balancer in front of CV-CUE that forwards client IP headers (e.g., X-Forwarded-For), allowing a remote attacker to inject a spoofed trusted IP. No credentials and no user interaction are required (PR:N/UI:N). The principal limiting factor is reachability of the backend and the header-handling configuration of any fronting proxy; deployments that strip or do not trust forwarded client-IP headers, and segments the attacker cannot reach, are not exposed via the remote path.

This is a credible, high-priority authentication-bypass flaw (CWE-290, spoofing) rather than an inflated-CVSS issue. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) with VC:H/VI:H/VA:H and a base score of 8.7 is internally consistent with the description: no privileges, no user interaction, and low complexity to forge a trusted source IP and obtain an administrative session. The impact triad is fully High because an attacker gains admin control of the CV-CUE backend. The key nuance is attack surface: the base vector rates this as adjacent (AV:A), but the description explicitly states that a reverse proxy or load balancer forwarding client headers (e.g., X-Forwarded-For) would expose it to attackers routed through that path - effectively extending reach toward network (AV:N) in common deployment topologies. Verify your deployment's proxy/header handling with Arista. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation likelihood cannot be quantified from the data; status is therefore 'no public exploit identified at time of analysis.' The absence of exploitation telemetry does not reduce severity - the trust-boundary design flaw is confirmed by the vendor advisory. Treat as a genuine priority for any CV-CUE operator, prioritizing instances fronted by header-forwarding proxies.

An attacker positioned on an adjacent private network segment (or able to send requests through a reverse proxy/load balancer that forwards client IP headers to CV-CUE) crafts requests that spoof a trusted source IP address. Because the backend authenticates administrative sessions based on that source IP, the attacker is granted an administrative session without credentials and takes full control of the CV-CUE management plane. No public exploit code was identified in the provided data.