---
id: "CVE-2026-122266"
kind: "vulnerability"
aliases: ["CVE-2026-122266"]
title: "CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aws", "eks", "infrastructure", "kubernetes", "lab-disclosure", "networkpolicy"]
not_affected_if: ["fixed-version", "no-network-policy-enforcement"]
published_at: null
first_seen_at: "2026-11-04T22:11:43+00:00"
updated_at: "2026-11-04T22:14:45+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-170-aws/", "first_seen_at": "2026-11-04T22:11:43+00:00"}]
exploit_sources: []
---

# CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS

The aws-network-policy-agent in Amazon EKS fails to isolate shared eBPF connection tracking state, so an authenticated user on an adjacent pod can bypass NetworkPolicy ingress enforcement on co-located pods. The result is that traffic a policy should block can reach pods it was meant to protect.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the version of aws-network-policy-agent and the Amazon VPC CNI managed add-on in the cluster.
- Confirm whether the cluster uses Kubernetes NetworkPolicy enforced by this agent (unknown whether the sources list a specific command).

## Fix

- aws-network-policy-agent: `1.3.7`
- Amazon VPC CNI Managed Add-on: `1.22.3`
- amazon-vpc-cni-k8s: `1.22.3`

## Timeline

- 2026-11-04T22:11:43+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-170-aws/ — AWS: CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS

## Documents

- [advisory] AWS: CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS https://aws.amazon.com/security/security-bulletins/rss/2026-170-aws/

## From the sources

CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS

### CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS

Bulletin ID: 2026-170-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/04/2026 13:30 PM PST

Description:

Amazon EKS Network Policy Agent (aws-network-policy-agent) is an open-source component of the Amazon VPC CNI that enforces Kubernetes NetworkPolicy on Amazon EKS clusters.

We identified CVE-2026-122266, an issue in Amazon EKS Network Policy Agent (aws-network-policy-agent). Improper isolation of shared eBPF connection tracking state might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods.

Impacted versions:

- aws-network-policy-agent < 1.3.7
- Amazon VPC CNI Managed Add-on < 1.22.3

Resolution:

This issue has been addressed in aws-network-policy-agent versions 1.3.7 and amazon-vpc-cni-k8s version 1.22.3. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There are no workarounds available.

References:

- CVE-2026-122266
- GHSA-mm5f-ggvx-hmvw

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_