Live › vulnerability › CVE-2026-86831
Go to dashboardThe EKS Network Policy Agent builds pod identifiers by joining pod name and namespace with a hyphen, so pods in different namespaces can get identical identifiers. An attacker with a pod in one namespace can bypass NetworkPolicy enforcement and reach workloads in another namespace.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:56 UTC, 0h before NVD. All times on this page are UTC.
Clusters on Amazon EKS that use the Network Policy Agent (through the VPC CNI add-on) to enforce NetworkPolicy between namespaces are exposed. Exposure depends on pod and namespace names that can collide once joined with a hyphen, so clusters that enforce isolation between namespaces are the ones to check. Clusters without NetworkPolicy enforcement or on patched versions can skip it.
No product ranges from the sources yet.
v1.4.0 or later.v1.22.4 or later (affected range is 1.14.0 to <1.22.3).kubectl get ns and look for hyphens in names that run workloads relying on NetworkPolicy isolation.1.4.0 or later.v1.22.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS
Bulletin ID: 2026-113-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/16/2026 12:30 PM PDT
Description:
Network Policy Agent is an EKS Policy management feature. We identified CVE-2026-86831, a cross-namespace NetworkPolicy bypass in Amazon EKS Network Policy Agent (aws-network-policy-agent) before v1.4.0. Pod identifiers are constructed by concatenating the pod name and namespace with a hyphen delimiter, which is a legal character in both Kubernetes pod names and namespace names. This ambiguity can produce identical identifiers for pods across different namespaces, potentially allowing NetworkPolicy enforcement to be bypassed.
Impacted versions:
Resolution:
To remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later.
Workarounds:
Customers can mitigate this issue by defining namespace names that do not contain hyphens (-). By avoiding hyphens in namespace names, the ambiguity in the identifier construction is eliminated, ensuring that pod identifiers remain unique across namespaces.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-86831")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.