CVE Feed

    Dashboard / CVE / CVE-2026-101152

    CVE-2026-101152

    Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision.

    Published:Oct 6, 2026
    Last Modified:Oct 9, 2026
    EPS:Oct 6, 2026
    EPSS Score:0.00379
    CVSS Score:8

    Affected Products

    Vendor
    Arista
    Product
    Cloudvision Portal

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-178 Cross-Site Flashing

    Related CVEs

    CVE-2026-101155 (CVSS 8.6) — An authenticated remote attacker with specific permissions can read or write files on the platform filesystem …
    CVE-2026-101154 (CVSS 8.6) — An authenticated remote attacker with specific permissions can read or write files on the platform filesystem …
    CVE-2026-101153 (CVSS 7.2) — On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability…
    CVE-2026-101151 (CVSS 5.3) — Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL…
    CVE-2026-101150 (CVSS 5.1) — Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to…
    CVE-2026-101149 (CVSS 5.1) — Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to…
    CVE-2026-101158 (CVSS 9.3) — A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with fi…
    CVE-2026-31431 (CVSS 7.8) — In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating …
    CVE-2025-0505 (CVSS 10) — On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be use…
    CVE-2023-24546 (CVSS 8.1) — On affected versions of the CloudVision Portal improper access controls on the connection from devices to Clou…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High