Live › vulnerability › GHSA-gjc7-c7mx-x8f3
Go to dashboardThe EKS Network Policy Agent builds pod identifiers by joining pod name and namespace with a hyphen, so pods in different namespaces can get the same identifier. This can let traffic bypass NetworkPolicy enforcement between namespaces.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:56 UTC. All times on this page are UTC.
Clusters running the aws-network-policy-agent on Amazon EKS with NetworkPolicy enforcement, where the VPC CNI managed add-on is in the affected version range (1.14.0 up to 1.22.3). The ambiguity needs hyphenated pod and namespace names that collide, so clusters that enforce isolation through NetworkPolicy and have hyphenated namespaces are the ones to check first. Clusters not using the network policy agent can skip it.
No product ranges from the sources yet.
kubectl get daemonset aws-node -n kube-system -o jsonpath='{.spec.template.spec.containers[*].image}', and compare against 1.4.0.aws eks describe-addon --cluster-name <cluster> --addon-name vpc-cni, and compare against v1.22.4.kubectl get namespaces -o name | grep -- '-' and check whether NetworkPolicies rely on namespace isolation.1.4.0 or later.v1.22.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS
Bulletin ID: 2026-113-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/16/2026 12:30 PM PDT
Description:
Network Policy Agent is an EKS Policy management feature. We identified CVE-2026-86831, a cross-namespace NetworkPolicy bypass in Amazon EKS Network Policy Agent (aws-network-policy-agent) before v1.4.0. Pod identifiers are constructed by concatenating the pod name and namespace with a hyphen delimiter, which is a legal character in both Kubernetes pod names and namespace names. This ambiguity can produce identical identifiers for pods across different namespaces, potentially allowing NetworkPolicy enforcement to be bypassed.
Impacted versions:
Resolution:
To remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later.
Workarounds:
Customers can mitigate this issue by defining namespace names that do not contain hyphens (-). By avoiding hyphens in namespace names, the ambiguity in the identifier construction is eliminated, ensuring that pod identifiers remain unique across namespaces.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-gjc7-c7mx-x8f3")