---
id: "CVE-2026-86831"
kind: "vulnerability"
aliases: ["CVE-2026-86831"]
title: "Amazon EKS Network Policy Agent: pod name collisions can bypass namespace isolation"
severity: "high"
cvss: 8.7
epss: 0.00643
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aws", "eks", "infrastructure", "kubernetes", "lab-disclosure", "network-policy"]
not_affected_if: ["no-network-policy-agent", "patched-version"]
published_at: "2026-09-16T00:00:00+00:00"
first_seen_at: "2026-10-24T18:56:54+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/", "first_seen_at": "2026-10-24T18:56:54+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86831", "first_seen_at": "2026-10-24T19:23:38+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-86831", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Amazon EKS Network Policy Agent: pod name collisions can bypass namespace isolation

The EKS Network Policy Agent builds pod identifiers by joining pod name and namespace with a hyphen, so pods in different namespaces can get identical identifiers. An attacker with a pod in one namespace can bypass NetworkPolicy enforcement and reach workloads in another namespace.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Network Policy Agent version in the aws-node daemonset image, which should be `v1.4.0` or later.
- Check the Amazon VPC CNI managed add-on version, which should be `v1.22.4` or later (affected range is `1.14.0` to `<1.22.3`).
- List namespaces with `kubectl get ns` and look for hyphens in names that run workloads relying on NetworkPolicy isolation.

## Fix

- Upgrade Amazon EKS Network Policy Agent to `1.4.0` or later.
- Upgrade Amazon VPC CNI Managed Add-on to `v1.22.4` or later.
- Workaround until patched: avoid hyphens in namespace names.

## Timeline

- 2026-10-24T18:56:54+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/ — AWS: CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS
- 2026-10-24T19:23:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86831
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-86831

## Documents

- [advisory] AWS: CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/

## From the sources

CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

### CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

Bulletin ID: 2026-113-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/16/2026 12:30 PM PDT

Description:

Network Policy Agent is an EKS Policy management feature. We identified CVE-2026-86831, a cross-namespace NetworkPolicy bypass in Amazon EKS Network Policy Agent (aws-network-policy-agent) before v1.4.0. Pod identifiers are constructed by concatenating the pod name and namespace with a hyphen delimiter, which is a legal character in both Kubernetes pod names and namespace names. This ambiguity can produce identical identifiers for pods across different namespaces, potentially allowing NetworkPolicy enforcement to be bypassed.

Impacted versions:

- 1.14.0<1.22.3 Amazon VPC CNI Managed Add-on
- < v1.4.0 Network Policy Agent

Resolution:

To remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later.

Workarounds:

Customers can mitigate this issue by defining namespace names that do not contain hyphens (-). By avoiding hyphens in namespace names, the ambiguity in the identifier construction is eliminated, ensuring that pod identifiers remain unique across namespaces.

References:

- CVE-2026-86831
- GHSA-7xv7-8r3j-3j25
- GHSA-gjc7-c7mx-x8f3

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_