CVE Feed

    Dashboard / CVE / CVE-2026-101149

    CVE-2026-101149

    Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.

    Published:Oct 6, 2026
    Last Modified:Oct 9, 2026
    EPS:Oct 6, 2026
    EPSS Score:0.00218
    CVSS Score:4.1

    Affected Products

    Vendor
    Arista
    Product
    Cloudvision Portal

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-918 Server-Side Request Forgery

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-101155 (CVSS 8.6) — An authenticated remote attacker with specific permissions can read or write files on the platform filesystem …
    CVE-2026-101154 (CVSS 8.6) — An authenticated remote attacker with specific permissions can read or write files on the platform filesystem …
    CVE-2026-101153 (CVSS 7.2) — On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability…
    CVE-2026-101152 (CVSS 7.6) — Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker …
    CVE-2026-101151 (CVSS 5.3) — Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL…
    CVE-2026-101150 (CVSS 5.1) — Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to…
    CVE-2026-101158 (CVSS 9.3) — A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with fi…
    CVE-2026-31431 (CVSS 7.8) — In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating …
    CVE-2025-0505 (CVSS 10) — On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be use…
    CVE-2023-24546 (CVSS 8.1) — On affected versions of the CloudVision Portal improper access controls on the connection from devices to Clou…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High