Live › vulnerability › GHSA-7xv7-8r3j-3j25
Go to dashboardThe EKS Network Policy Agent builds pod identifiers by joining pod name and namespace with a hyphen, and both can contain hyphens, so pods in different namespaces can get the same identifier. An attacker with a pod in a crafted namespace can get NetworkPolicy enforcement bypassed for another namespace's pods.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:56 UTC. All times on this page are UTC.
Clusters on Amazon EKS that use NetworkPolicy enforcement through the Network Policy Agent in the VPC CNI add-on are exposed. The risk is greatest where namespaces with hyphens in their names are used to separate tenants or workloads. Clusters without NetworkPolicy enforcement, or with the agent already upgraded, can skip it.
No product ranges from the sources yet.
kubectl describe daemonset aws-node -n kube-system and look at the aws-network-policy-agent image tag; affected if below 1.4.0.aws eks describe-addon --cluster-name <cluster> --addon-name vpc-cni; affected if between 1.14.0 and 1.22.3.kubectl get namespaces and check whether NetworkPolicies depend on isolation between them.1.4.0 or later.v1.22.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS
Bulletin ID: 2026-113-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/16/2026 12:30 PM PDT
Description:
Network Policy Agent is an EKS Policy management feature. We identified CVE-2026-86831, a cross-namespace NetworkPolicy bypass in Amazon EKS Network Policy Agent (aws-network-policy-agent) before v1.4.0. Pod identifiers are constructed by concatenating the pod name and namespace with a hyphen delimiter, which is a legal character in both Kubernetes pod names and namespace names. This ambiguity can produce identical identifiers for pods across different namespaces, potentially allowing NetworkPolicy enforcement to be bypassed.
Impacted versions:
Resolution:
To remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later.
Workarounds:
Customers can mitigate this issue by defining namespace names that do not contain hyphens (-). By avoiding hyphens in namespace names, the ambiguity in the identifier construction is eliminated, ensuring that pod identifiers remain unique across namespaces.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-7xv7-8r3j-3j25")