This vulnerability in Arista Networks VeloCloud Orchestrator On-Prem (VCO) involves insufficient validation of input from authenticated users with Enterprise Standard Admin privileges. It enables these users to perform SSRF attacks by making requests on behalf of tenant accounts to internal services that are not normally accessible externally. The vulnerability is tracked as CVE-2026-17192 and is classified under CWE-918. It affects versions 5.2.0, 6.1.0, and 6.4.0 of the product. The CVSS v3.1 base score is 8.5, indicating high severity, with attack vector network, low attack complexity, privileges required at the level of Enterprise Standard Admin, no user interaction, scope changed, high confidentiality impact, low integrity impact, and no availability impact. Arista discovered this issue internally and is not aware of any malicious exploitation to date. No official remediation or patch information is provided in the available data.

An attacker with Enterprise Standard Admin privileges can exploit this SSRF vulnerability to send unauthorized requests to internal services that are not otherwise accessible, potentially leading to disclosure of sensitive information (high confidentiality impact) and limited integrity impact. There is no impact on availability. The scope of the vulnerability is changed, indicating that the exploit can affect resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Arista's advisories for updates. Until a patch is available, restrict Enterprise Standard Admin role assignments to trusted personnel only and review access controls to minimize risk.