CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS
Bulletin ID: 2026-113-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 09/16/2026 12:30 PM PDT
Description:
Network Policy Agent is an EKS Policy management feature. We identified CVE-2026-86831, a cross-namespace NetworkPolicy bypass in Amazon EKS Network Policy Agent (aws-network-policy-agent) before v1.4.0. Pod identifiers are constructed by concatenating the pod name and namespace with a hyphen delimiter, which is a legal character in both Kubernetes pod names and namespace names. This ambiguity can produce identical identifiers for pods across different namespaces, potentially allowing NetworkPolicy enforcement to be bypassed.
Impacted versions:
- 1.14.0<1.22.3 Amazon VPC CNI Managed Add-on
- < v1.4.0 Network Policy Agent
Resolution:
To remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later.
Workarounds:
Customers can mitigate this issue by defining namespace names that do not contain hyphens (-). By avoiding hyphens in namespace names, the ambiguity in the identifier construction is eliminated, ensuring that pod identifiers remain unique across namespaces.
References:
Please email aws-security@amazon.com with any security questions or concerns.