Skip to main content

CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS

Bulletin ID: 2026-170-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 11/04/2026 13:30 PM PST

Description:

Amazon EKS Network Policy Agent (aws-network-policy-agent) is an open-source component of the Amazon VPC CNI that enforces Kubernetes NetworkPolicy on Amazon EKS clusters.

We identified CVE-2026-122266, an issue in Amazon EKS Network Policy Agent (aws-network-policy-agent). Improper isolation of shared eBPF connection tracking state might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods.

Impacted versions:

  • aws-network-policy-agent < 1.3.7
  • Amazon VPC CNI Managed Add-on < 1.22.3

Resolution:

This issue has been addressed in aws-network-policy-agent versions 1.3.7 and amazon-vpc-cni-k8s version 1.22.3. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There are no workarounds available.

References:


Please email aws-security@amazon.com with any security questions or concerns.