This vulnerability (CVE-2026-73457) involves the insertion of sensitive information (gNPSI client credentials) into log files in Arista EOS under certain conditions when gNPSI is enabled. The credentials may be exposed in clear text within local or remote accounting logs, potentially allowing authenticated users with access to these logs to obtain sensitive authentication information. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

The exposure of gNPSI client credentials in clear text logs could allow an authenticated user with access to accounting logs to obtain sensitive credentials, potentially leading to unauthorized access or misuse of the gNPSI interface. However, exploitation requires authenticated access and the gNPSI feature enabled, limiting the scope of impact.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to accounting logs to trusted authenticated users only and consider disabling gNPSI if not required.