CVE-2026-17192 Details

A server-side request forgery (SSRF) vulnerability has been identified in Arista VeloCloud Orchestrator (VCO) versions 5.2.x prior to 5.2.3.14, 6.1.x prior to 6.1.3.4, and 6.4.x prior to 6.4.2.4. This vulnerability arises from insufficient validation of caller-supplied input, allowing authenticated users with a minimum role of Enterprise Standard Admin to send requests on behalf of tenant accounts to internal services that are not normally accessible. The issue was discovered internally by Arista, which is not aware of any malicious exploitation in customer networks.

Users are advised to upgrade to VCO versions 5.2.3.14 or later, 6.1.3.4 or later, or 6.4.2.4 or later. For VCOs not on a supported release train, customers can contact Arista's Technical Assistance Center (TAC) to discuss possible upgrade options. Until the upgrade is applied, it is recommended to restrict access to the VCO web interface to trusted administrative networks, monitor for accesses from known malicious source IPs, watch for unexpected outbound network activity from the VCO host, and review recent administrator activity for any unexpected changes.