CWE-842 vulnerabilities

CVE-2026-73439 is a high-severity vulnerability in Arista Networks EOS affecting versions 4.33.2F through 4.33.8M, 4.34.0F through 4.34.6M, 4.35.0F through 4.35.5M, and 4.36.0F through 4.36.0.1F. It occurs when OpenConfig is configured with a gNMI server and a gNSI Pathz policy containing both group and user rules for the same path. Under these conditions, gNMI may fail to enforce the Pathz policy correctly, allowing an authenticated user to gain unauthorized read or write permissions on restricted gNMI paths. The vulnerability has a CVSS 3.1 score of 7.5, indicating high impact on confidentiality, integrity, and availability. No information about patches or vendor advisories is provided, so patch status is not confirmed.

authd prior to version 0.6.4 contains a logic error in primary group ID assignment that can lead to local privilege escalation. When a user's primary group ID (GID) differs from their UID, either because the account was created with authd prior to version 0.5.4 or because the primary group was manually changed via the `authctl group set-gid` command, and the user's identity provider record is updated, authd incorrectly resets the user's primary group ID to their UID upon next login. This causes newly created files and directories to be owned by the wrong group, causing denial of service issues, and potentially granting unintended access to other local users and allowing local privilege escalation.

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.