{"id":"CVE-2026-86831","kind":"vulnerability","aliases":["CVE-2026-86831"],"related":[],"title":"Amazon EKS Network Policy Agent: pod name collisions can bypass namespace isolation","description":"CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS\n\n### CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS\n\nBulletin ID: 2026-113-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/16/2026 12:30 PM PDT\n\nDescription:\n\nNetwork Policy Agent is an EKS Policy management feature. We identified CVE-2026-86831, a cross-namespace NetworkPolicy bypass in Amazon EKS Network Policy Agent (aws-network-policy-agent) before v1.4.0. Pod identifiers are constructed by concatenating the pod name and namespace with a hyphen delimiter, which is a legal character in both Kubernetes pod names and namespace names. This ambiguity can produce identical identifiers for pods across different namespaces, potentially allowing NetworkPolicy enforcement to be bypassed.\n\nImpacted versions:\n\n- 1.14.0<1.22.3 Amazon VPC CNI Managed Add-on\n- < v1.4.0 Network Policy Agent\n\nResolution:\n\nTo remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later.\n\nWorkarounds:\n\nCustomers can mitigate this issue by defining namespace names that do not contain hyphens (-). By avoiding hyphens in namespace names, the ambiguity in the identifier construction is eliminated, ensuring that pod identifiers remain unique across namespaces.\n\nReferences:\n\n- CVE-2026-86831\n- GHSA-7xv7-8r3j-3j25\n- GHSA-gjc7-c7mx-x8f3\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The EKS Network Policy Agent builds pod identifiers by joining pod name and namespace with a hyphen, so pods in different namespaces can get identical identifiers. An attacker with a pod in one namespace can bypass NetworkPolicy enforcement and reach workloads in another namespace.","severity":"high","cvss":8.7,"epss":0.00643,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","eks","infrastructure","kubernetes","lab-disclosure","network-policy"],"not_affected_if":["no-network-policy-agent","patched-version"],"how_to_check":"- Check the Network Policy Agent version in the aws-node daemonset image, which should be `v1.4.0` or later.\n- Check the Amazon VPC CNI managed add-on version, which should be `v1.22.4` or later (affected range is `1.14.0` to `<1.22.3`).\n- List namespaces with `kubectl get ns` and look for hyphens in names that run workloads relying on NetworkPolicy isolation.","fix":"- Upgrade Amazon EKS Network Policy Agent to `1.4.0` or later.\n- Upgrade Amazon VPC CNI Managed Add-on to `v1.22.4` or later.\n- Workaround until patched: avoid hyphens in namespace names.","status":"open","published_at":"2026-09-16T00:00:00+00:00","first_seen_at":"2026-10-24T18:56:54+00:00","triaged_at":"2026-10-25T05:29:32+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T05:29:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Amazon EKS Network Policy Agent to `1.4.0` or later.\n- Upgrade Amazon VPC CNI Managed Add-on to `v1.22.4` or later.\n- Workaround until patched: avoid hyphens in namespace names.","reach":"network","title":"Amazon EKS Network Policy Agent: pod name collisions can bypass namespace isolation","impact":"medium","summary":"The EKS Network Policy Agent builds pod identifiers by joining pod name and namespace with a hyphen, so pods in different namespaces can get identical identifiers. An attacker with a pod in one namespace can bypass NetworkPolicy enforcement and reach workloads in another namespace.","category":"infrastructure","nicknames":[],"who_cares":["eks","kubernetes","aws","network-policy"],"confidence":0.7,"needs_auth":"yes","worst_case":"Cross-namespace NetworkPolicy enforcement is bypassed, exposing other namespaces' pods.","analyst_note":"","how_to_check":"- Check the Network Policy Agent version in the aws-node daemonset image, which should be `v1.4.0` or later.\n- Check the Amazon VPC CNI managed add-on version, which should be `v1.22.4` or later (affected range is `1.14.0` to `<1.22.3`).\n- List namespaces with `kubectl get ns` and look for hyphens in names that run workloads relying on NetworkPolicy isolation.","needs_analyst":false,"not_affected_if":["patched-version","no-network-policy-agent"],"who_is_affected":"Clusters on Amazon EKS that use the Network Policy Agent (through the VPC CNI add-on) to enforce NetworkPolicy between namespaces are exposed. Exposure depends on pod and namespace names that can collide once joined with a hyphen, so clusters that enforce isolation between namespaces are the ones to check. Clusters without NetworkPolicy enforcement or on patched versions can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000763,"input_tokens":3978,"output_tokens":731,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113':112C '-2026':14A,17A,74C,92C,141C,290C '-86831':15A,18A,75C,93C,142C,291C '09/16/2026':123C '1.14.0':210C '1.22.3':211C '1.4.0':237C '12':124C '2026':111C '30':125C '3j25':296C '7xv7':294C '8r3j':295C 'across':198C,286C 'add':217C,246C 'add-on':216C,245C 'agent':5A,33B,87C,105C,131C,154C,159C,222C,236C 'allow':202C 'amazon':1A,89C,107C,150C,212C,232C,241C 'ambigu':191C,273C 'anoth':71B 'attack':56B 'attent':120C 'avoid':267C 'aw':19B,84C,102C,113C,115C,156C 'aws-network-policy-ag':83C,101C,155C 'aws-security@amazon.com':304C 'build':34B 'bulletin':109C 'bypass':10A,64B,148C,207C 'c7mx':300C 'charact':181C 'cni':214C,243C 'collis':8A 'concaten':167C 'concern':310C 'construct':165C,277C 'contain':264C 'content':116C 'cross':145C 'cross-namespac':144C 'custom':252C 'cve':13A,16A,73C,91C,140C,289C 'date':122C 'defin':258C 'delimit':176C 'descript':128C 'differ':49B,199C 'disclosur':25B 'ek':2A,20B,30B,90C,108C,134C,151C,233C 'elimin':279C 'email':303C 'enforc':66B,204C 'ensur':280C 'featur':137C 'get':52B 'ghsa':293C,298C 'ghsa-7xv7-8r3j-3j25':292C 'ghsa-gjc7-c7mx-x8f3':297C 'gjc7':299C 'hyphen':45B,175C,265C,268C 'id':110C 'ident':53B,194C 'identifi':36B,54B,80C,98C,139C,163C,195C,276C,283C 'impact':208C 'import':118C 'improp':76C,94C 'infrastructur':21B 'isol':12A 'issu':227C,256C 'join':38B 'kubernet':22B,184C 'lab':24B 'lab-disclosur':23B 'later':239C,250C 'legal':180C 'manag':136C,215C,244C 'mitig':254C 'name':7A,40B,170C,186C,189C,260C,271C 'namespac':11A,42B,50B,62B,72B,146C,172C,188C,200C,259C,270C,287C 'network':3A,27B,31B,85C,103C,129C,152C,157C,220C,234C 'network-polici':26B 'networkpolici':65B,147C,203C 'one':61B 'pdt':127C 'pleas':302C 'pm':126C 'pod':6A,35B,39B,47B,59B,79C,97C,162C,169C,185C,197C,282C 'polici':4A,28B,32B,86C,104C,130C,135C,153C,158C,221C,235C 'potenti':201C 'produc':193C 'public':121C 'question':308C 'reach':68B 'refer':288C 'remain':284C 'remedi':225C 'requir':119C 'resolut':223C 'scope':114C 'secur':307C 'type':117C 'uniqu':81C,99C,285C 'upgrad':230C 'user':228C 'v1.22.4':248C 'v1.4.0':161C,219C 'valid':77C,95C 'version':209C 'vpc':213C,242C 'workaround':251C 'workload':69B 'x8f3':301C","nicknames":[],"mitigations":[],"who_affected":"Clusters on Amazon EKS that use the Network Policy Agent (through the VPC CNI add-on) to enforce NetworkPolicy between namespaces are exposed. Exposure depends on pod and namespace names that can collide once joined with a hyphen, so clusters that enforce isolation between namespaces are the ones to check. Clusters without NetworkPolicy enforcement or on patched versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-16T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/#CVE-2026-86831","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/","severity":null,"published_at":"2026-09-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:54+00:00","fetched_at":"2026-10-24T18:56:54+00:00","note":"AWS: CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS"},{"source":"nvd","external_id":"CVE-2026-86831","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86831","severity":null,"published_at":"2026-09-16T20:17:36+00:00","modified_at":"2026-10-20T19:19:08+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null},{"source":"epss","external_id":"CVE-2026-86831","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86831","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2914,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/","title":"AWS: CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS","kind":"advisory","source":"lab","text":"CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS\n\n### CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS\n\nBulletin ID: 2026-113-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/16/2026 12:30 PM PDT\n\nDescription:\n\nNetwork Policy Agent is an EKS Policy management feature. We identified CVE-2026-86831, a cross-namespace NetworkPolicy bypass in Amazon EKS Network Policy Agent (aws-network-policy-agent) before v1.4.0. Pod identifiers are constructed by concatenating the pod name and namespace with a hyphen delimiter, which is a legal character in both Kubernetes pod names and namespace names. This ambiguity can produce identical identifiers for pods across different namespaces, potentially allowing NetworkPolicy enforcement to be bypassed.\n\nImpacted versions:\n\n- 1.14.0<1.22.3 Amazon VPC CNI Managed Add-on\n- < v1.4.0 Network Policy Agent\n\nResolution:\n\nTo remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later.\n\nWorkarounds:\n\nCustomers can mitigate this issue by defining namespace names that do not contain hyphens (-). By avoiding hyphens in namespace names, the ambiguity in the identifier construction is eliminated, ensuring that pod identifiers remain unique across namespaces.\n\nReferences:\n\n- CVE-2026-86831\n- GHSA-7xv7-8r3j-3j25\n- GHSA-gjc7-c7mx-x8f3\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-09-16T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}