CVE-2026-102158: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in Arista Networks CloudVision CUE

This vulnerability (CWE-74) arises from improper neutralization of special elements in output used by a downstream component within the CloudVision CUE API. Specifically, certain API request parameters are not properly validated, enabling an authenticated network user to inject SQL commands into the backend database. The injection can disrupt backend availability, causing denial of service conditions. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

An authenticated network user can exploit this vulnerability to perform SQL injection attacks against the backend database of CloudVision CUE, resulting in disruption or denial of service to the backend system. There is no impact on confidentiality or integrity according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud service, remediation depends on vendor patch releases. Until a patch is available, restrict access to the affected API to trusted users only and monitor for unusual activity related to API requests. Do not assume the vulnerability is mitigated without official vendor confirmation.