CVE-2026-101151: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') in Arista Networks CloudVision Portal

This vulnerability (CWE-601) in Arista Networks CloudVision Portal occurs due to improper validation of redirect URLs in the login process. An attacker can create a malicious URL that, when clicked by a user, causes the user's browser to redirect to an external, potentially untrusted site after successful authentication. The flaw affects multiple versions of the product, including versions from 2020.3.0 up to and including 2026.1.2 and version 2026.2.0. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and limited confidentiality impact.

The impact is limited to potential redirection of authenticated users to arbitrary external websites controlled by attackers. This could facilitate phishing or social engineering attacks but does not directly compromise confidentiality, integrity, or availability of the CloudVision Portal itself. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor Arista Networks advisories for updates. Until a fix is available, users should be cautious about clicking on unexpected URLs related to the CloudVision Portal login flow.