A server‑side request forgery flaw was discovered in the VeloCloud Orchestrator (VCO) web interface. The bug permits an authenticated Enterprise Standard Admin to supply unvalidated input that causes the VCO to issue HTTP requests to arbitrary internal endpoints that would normally be unreachable. An attacker could therefore reach internal services, transfer data, or execute commands in the VCO’s host environment. The flaw enables unauthorized internal resource access, potentially exposing sensitive information or compromising network services.

Arista Networks’ VeloCloud Orchestrator On‑Prem product is affected. Versions earlier than VCO 5.2.3.14 in the 5.2 train, prior to VCO 6.1.3.4 in the 6.1 train, and before VCO 6.4.2.4 in the 6.4 train contain the vulnerability. Systems running those releases and any other unsupported train should be evaluated for presence of this SSRF flaw.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of 2% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalogue. SSRF requires an authenticated Enterprise Standard Admin role, so exploitation relies on privileged access or compromise of such accounts. Attackers could initiate internal requests from the web interface, potentially leading to data exfiltration or unintended service execution. Defense‑in‑depth controls are recommended until a patched release is available.