CVE-2026-122266 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The aws-network-policy-agent in Amazon EKS fails to isolate shared eBPF connection tracking state, so an authenticated user on an adjacent pod can bypass NetworkPolicy ingress enforcement on co-located pods. The result is that traffic a policy should block can reach pods it was meant to protect.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clusters on Amazon EKS that use the aws-network-policy-agent to enforce Kubernetes NetworkPolicy are exposed, and the attacker must already be an authenticated user on an adjacent pod. Teams whose clusters run an unaffected version or do not rely on this agent for policy enforcement can skip it. The sources do not say which default configurations enable the agent.
Not affected if fixed-version, no-network-policy-enforcement
Who cares aws, eks, kubernetes, lab-disclosure, networkpolicy
1.3.71.22.31.22.3CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS
Bulletin ID: 2026-170-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/04/2026 13:30 PM PST
Description:
Amazon EKS Network Policy Agent (aws-network-policy-agent) is an open-source component of the Amazon VPC CNI that enforces Kubernetes NetworkPolicy on Amazon EKS clusters.
We identified CVE-2026-122266, an issue in Amazon EKS Network Policy Agent (aws-network-policy-agent). Improper isolation of shared eBPF connection tracking state might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods.
Impacted versions:
Resolution:
This issue has been addressed in aws-network-policy-agent versions 1.3.7 and amazon-vpc-cni-k8s version 1.22.3. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
There are no workarounds available.
References:
Please email aws-security@amazon.com with any security questions or concerns.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.