CVE-2026-102157: CWE-639 Authorization Bypass Through User-Controlled Key in Arista Networks CloudVision CUE

This vulnerability in Arista Networks CloudVision CUE arises from an insecure direct object reference (IDOR) in the file-serving interface. An authenticated user with low privileges can, under specific attack conditions, bypass authorization controls to access transient data belonging to other users. The vulnerability affects versions >=2021.2.0 and <=2026.2.0. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.

An authenticated network user with low privileges may access transient data of other users, potentially exposing sensitive information. The impact is primarily confidentiality loss with no integrity impact and low availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor Arista Networks advisories for updates. Until a fix is available, restrict access to the affected interface and limit authenticated user privileges where possible.