{
  "id": 18939020,
  "title": "VeloCloud Shows Why Integration Endpoint Trust Needs an Owner",
  "url": "https://urgent.news/2026/11/08/velocloud-shows-why-integration-endpoint-trust-needs-an-owner",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-08T13:10:20.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ntctech/velocloud-shows-why-integration-endpoint-trust-needs-an-owner-192i"
  },
  "original_language": "en",
  "account": "Arista published a security advisory on November 2, 2026, addressing a memory-corruption flaw in the Brotli decoder of its VeloCloud Orchestrator (VCO) platform. This flaw, CVE-2026-111497, can be exploited if the affected runtime processes a crafted Brotli response through an outbound HTTP client that automatically decompresses the response. Arista stated that exploitation requires specific conditions to be met, and that VCO deployments are not inherently vulnerable. It is unclear if VCO has been exploited through this path, or if any specific integration paths have been compromised. Arista recommends upgrading to a fixed version to mitigate the risk. The advisory highlights the importance of owning and validating the validation boundary surrounding content returned by configured integration endpoints. This is because the vulnerability exists at the decoder stage, and the decisions determining what reaches it occur upstream. The flaw lies in the four-step process of opening a connection to a configured integration endpoint, receiving a response, decompressing the response, and processing the bytes. The exposure assessment should consider the outbound steps, such as the destination, redirects, and the HTTP client's decompression behavior, rather than solely focusing on inbound reachability.",
  "summary": "Integration endpoint trust is the part of an orchestrator's exposure that an inbound-reachability review can miss. On November 2, 2026, Arista published Security Advisory 0202 for VeloCloud Orchestrator (VCO), the platform that configures, monitors and manages VeloCloud SD-WAN deployments, covering CVE-2026-111497, a memory-corruption flaw in the Brotli decoder. Arista's wording draws the line…",
  "key_points": [
    "Arista published security advisory on VeloCloud Orchestrator vulnerability.",
    "Memory-corruption flaw in Brotli decoder exploitable via crafted responses.",
    "Upgrading to fixed version recommended to mitigate exploitation risk."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}