{"id":"GHSA-7xv7-8r3j-3j25","kind":"vulnerability","aliases":["GHSA-7xv7-8r3j-3j25"],"related":[],"title":"CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS","description":"CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS\n\n### CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS\n\nBulletin ID: 2026-113-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/16/2026 12:30 PM PDT\n\nDescription:\n\nNetwork Policy Agent is an EKS Policy management feature. We identified CVE-2026-86831, a cross-namespace NetworkPolicy bypass in Amazon EKS Network Policy Agent (aws-network-policy-agent) before v1.4.0. Pod identifiers are constructed by concatenating the pod name and namespace with a hyphen delimiter, which is a legal character in both Kubernetes pod names and namespace names. This ambiguity can produce identical identifiers for pods across different namespaces, potentially allowing NetworkPolicy enforcement to be bypassed.\n\nImpacted versions:\n\n- 1.14.0<1.22.3 Amazon VPC CNI Managed Add-on\n- < v1.4.0 Network Policy Agent\n\nResolution:\n\nTo remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later.\n\nWorkarounds:\n\nCustomers can mitigate this issue by defining namespace names that do not contain hyphens (-). By avoiding hyphens in namespace names, the ambiguity in the identifier construction is eliminated, ensuring that pod identifiers remain unique across namespaces.\n\nReferences:\n\n- CVE-2026-86831\n- GHSA-7xv7-8r3j-3j25\n- GHSA-gjc7-c7mx-x8f3\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The EKS Network Policy Agent builds pod identifiers by joining pod name and namespace with a hyphen, and both can contain hyphens, so pods in different namespaces can get the same identifier. An attacker with a pod in a crafted namespace can get NetworkPolicy enforcement bypassed for another namespace's pods.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","eks","infrastructure","kubernetes","lab-disclosure","network-policy","vpc-cni"],"not_affected_if":["no-hyphenated-namespaces","no-network-policies","patched-agent"],"how_to_check":"- Check the Network Policy Agent version with `kubectl describe daemonset aws-node -n kube-system` and look at the aws-network-policy-agent image tag; affected if below `1.4.0`.\n- Check the VPC CNI managed add-on version with `aws eks describe-addon --cluster-name <cluster> --addon-name vpc-cni`; affected if between `1.14.0` and `1.22.3`.\n- List namespaces containing hyphens with `kubectl get namespaces` and check whether NetworkPolicies depend on isolation between them.","fix":"- Upgrade Amazon EKS Network Policy Agent to `1.4.0` or later.\n- Upgrade the Amazon VPC CNI Managed Add-on to `v1.22.4` or later.\n- Until upgraded, avoid hyphens in namespace names, as the bulletin's workaround states.","status":"open","published_at":"2026-09-16T00:00:00+00:00","first_seen_at":"2026-10-24T18:56:54+00:00","triaged_at":"2026-10-25T05:30:30+00:00","updated_at":"2026-10-25T05:30:30+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T05:30:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Amazon EKS Network Policy Agent to `1.4.0` or later.\n- Upgrade the Amazon VPC CNI Managed Add-on to `v1.22.4` or later.\n- Until upgraded, avoid hyphens in namespace names, as the bulletin's workaround states.","reach":"network","title":"Amazon EKS network policy agent: pod identifier collision bypasses NetworkPolicy across namespaces","impact":"medium","summary":"The EKS Network Policy Agent builds pod identifiers by joining pod name and namespace with a hyphen, and both can contain hyphens, so pods in different namespaces can get the same identifier. An attacker with a pod in a crafted namespace can get NetworkPolicy enforcement bypassed for another namespace's pods.","category":"infrastructure","nicknames":[],"who_cares":["eks","kubernetes","vpc-cni","network-policy"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Network isolation between namespaces is bypassed, letting pods reach protected workloads.","analyst_note":"Confirm the exploit preconditions (whether an attacker needs the ability to create pods in a namespace) at https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/ and the linked GHSA-gjc7-c7mx-x8f3 entry.","how_to_check":"- Check the Network Policy Agent version with `kubectl describe daemonset aws-node -n kube-system` and look at the aws-network-policy-agent image tag; affected if below `1.4.0`.\n- Check the VPC CNI managed add-on version with `aws eks describe-addon --cluster-name <cluster> --addon-name vpc-cni`; affected if between `1.14.0` and `1.22.3`.\n- List namespaces containing hyphens with `kubectl get namespaces` and check whether NetworkPolicies depend on isolation between them.","needs_analyst":true,"not_affected_if":["no-network-policies","patched-agent","no-hyphenated-namespaces"],"who_is_affected":"Clusters on Amazon EKS that use NetworkPolicy enforcement through the Network Policy Agent in the VPC CNI add-on are exposed. The risk is greatest where namespaces with hyphens in their names are used to separate tenants or workloads. Clusters without NetworkPolicy enforcement, or with the agent already upgraded, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000839,"input_tokens":3957,"output_tokens":886,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113':132C '-2026':2A,94C,112C,161C,310C '-86831':3A,95C,113C,162C,311C '09/16/2026':143C '1.14.0':230C '1.22.3':231C '1.4.0':257C '12':144C '2026':131C '30':145C '3j25':23A,28A,316C '7xv7':21A,26A,314C '8r3j':22A,27A,315C 'across':218C,306C 'add':237C,266C 'add-on':236C,265C 'agent':15A,46B,107C,125C,151C,174C,179C,242C,256C 'allow':222C 'amazon':17A,109C,127C,170C,232C,252C,261C 'ambigu':211C,293C 'anoth':89B 'attack':75B 'attent':140C 'avoid':287C 'aw':12A,29B,104C,122C,133C,135C,176C 'aws-network-policy-ag':11A,103C,121C,175C 'aws-security@amazon.com':324C 'build':47B 'bulletin':129C 'bypass':87B,168C,227C 'c7mx':320C 'charact':201C 'cni':41B,234C,263C 'concaten':187C 'concern':330C 'construct':185C,297C 'contain':62B,284C 'content':136C 'craft':81B 'cross':165C 'cross-namespac':164C 'custom':272C 'cve':1A,93C,111C,160C,309C 'date':142C 'defin':278C 'delimit':196C 'descript':148C 'differ':67B,219C 'disclosur':35B 'ek':18A,30B,43B,110C,128C,154C,171C,253C 'elimin':299C 'email':323C 'enforc':86B,224C 'ensur':300C 'featur':157C 'get':70B,84B 'ghsa':20A,25A,313C,318C 'ghsa-7xv7-8r3j-3j25':19A,24A,312C 'ghsa-gjc7-c7mx-x8f3':317C 'gjc7':319C 'hyphen':58B,63B,195C,285C,288C 'id':130C 'ident':214C 'identifi':8A,49B,73B,100C,118C,159C,183C,215C,296C,303C 'impact':228C 'import':138C 'improp':4A,96C,114C 'infrastructur':31B 'issu':247C,276C 'join':51B 'kubernet':32B,204C 'lab':34B 'lab-disclosur':33B 'later':259C,270C 'legal':200C 'manag':156C,235C,264C 'mitig':274C 'name':53B,190C,206C,209C,280C,291C 'namespac':55B,68B,82B,90B,166C,192C,208C,220C,279C,290C,307C 'network':13A,37B,44B,105C,123C,149C,172C,177C,240C,254C 'network-polici':36B 'networkpolici':85B,167C,223C 'pdt':147C 'pleas':322C 'pm':146C 'pod':7A,48B,52B,65B,78B,92B,99C,117C,182C,189C,205C,217C,302C 'polici':14A,38B,45B,106C,124C,150C,155C,173C,178C,241C,255C 'potenti':221C 'produc':213C 'public':141C 'question':328C 'refer':308C 'remain':304C 'remedi':245C 'requir':139C 'resolut':243C 'scope':134C 'secur':327C 'type':137C 'uniqu':9A,101C,119C,305C 'upgrad':250C 'user':248C 'v1.22.4':268C 'v1.4.0':181C,239C 'valid':5A,97C,115C 'version':229C 'vpc':40B,233C,262C 'vpc-cni':39B 'workaround':271C 'x8f3':321C","nicknames":[],"mitigations":[],"who_affected":"Clusters on Amazon EKS that use NetworkPolicy enforcement through the Network Policy Agent in the VPC CNI add-on are exposed. The risk is greatest where namespaces with hyphens in their names are used to separate tenants or workloads. Clusters without NetworkPolicy enforcement, or with the agent already upgraded, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-16T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/#GHSA-7xv7-8r3j-3j25","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/","severity":null,"published_at":"2026-09-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:54+00:00","fetched_at":"2026-10-24T18:56:54+00:00","note":"AWS: CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS"}],"documents":[{"id":2914,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/","title":"AWS: CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS","kind":"advisory","source":"lab","text":"CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS\n\n### CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS\n\nBulletin ID: 2026-113-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/16/2026 12:30 PM PDT\n\nDescription:\n\nNetwork Policy Agent is an EKS Policy management feature. We identified CVE-2026-86831, a cross-namespace NetworkPolicy bypass in Amazon EKS Network Policy Agent (aws-network-policy-agent) before v1.4.0. Pod identifiers are constructed by concatenating the pod name and namespace with a hyphen delimiter, which is a legal character in both Kubernetes pod names and namespace names. This ambiguity can produce identical identifiers for pods across different namespaces, potentially allowing NetworkPolicy enforcement to be bypassed.\n\nImpacted versions:\n\n- 1.14.0<1.22.3 Amazon VPC CNI Managed Add-on\n- < v1.4.0 Network Policy Agent\n\nResolution:\n\nTo remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later.\n\nWorkarounds:\n\nCustomers can mitigate this issue by defining namespace names that do not contain hyphens (-). By avoiding hyphens in namespace names, the ambiguity in the identifier construction is eliminated, ensuring that pod identifiers remain unique across namespaces.\n\nReferences:\n\n- CVE-2026-86831\n- GHSA-7xv7-8r3j-3j25\n- GHSA-gjc7-c7mx-x8f3\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-09-16T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}