{"id":"GHSA-gjc7-c7mx-x8f3","kind":"vulnerability","aliases":["GHSA-gjc7-c7mx-x8f3"],"related":[],"title":"CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS","description":"CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS\n\n### CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS\n\nBulletin ID: 2026-113-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/16/2026 12:30 PM PDT\n\nDescription:\n\nNetwork Policy Agent is an EKS Policy management feature. We identified CVE-2026-86831, a cross-namespace NetworkPolicy bypass in Amazon EKS Network Policy Agent (aws-network-policy-agent) before v1.4.0. Pod identifiers are constructed by concatenating the pod name and namespace with a hyphen delimiter, which is a legal character in both Kubernetes pod names and namespace names. This ambiguity can produce identical identifiers for pods across different namespaces, potentially allowing NetworkPolicy enforcement to be bypassed.\n\nImpacted versions:\n\n- 1.14.0<1.22.3 Amazon VPC CNI Managed Add-on\n- < v1.4.0 Network Policy Agent\n\nResolution:\n\nTo remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later.\n\nWorkarounds:\n\nCustomers can mitigate this issue by defining namespace names that do not contain hyphens (-). By avoiding hyphens in namespace names, the ambiguity in the identifier construction is eliminated, ensuring that pod identifiers remain unique across namespaces.\n\nReferences:\n\n- CVE-2026-86831\n- GHSA-7xv7-8r3j-3j25\n- GHSA-gjc7-c7mx-x8f3\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The EKS Network Policy Agent builds pod identifiers by joining pod name and namespace with a hyphen, so pods in different namespaces can get the same identifier. This can let traffic bypass NetworkPolicy enforcement between namespaces.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","eks","infrastructure","kubernetes","lab-disclosure","network-policy","vpc-cni"],"not_affected_if":["no-hyphenated-namespaces","no-network-policy-agent"],"how_to_check":"- Check the Network Policy Agent version in the cluster, for example `kubectl get daemonset aws-node -n kube-system -o jsonpath='{.spec.template.spec.containers[*].image}'`, and compare against `1.4.0`.\n- Check the VPC CNI managed add-on version in the EKS console or with `aws eks describe-addon --cluster-name <cluster> --addon-name vpc-cni`, and compare against `v1.22.4`.\n- List namespaces containing hyphens with `kubectl get namespaces -o name | grep -- '-'` and check whether NetworkPolicies rely on namespace isolation.","fix":"- Upgrade Amazon EKS Network Policy Agent to `1.4.0` or later.\n- Upgrade the Amazon VPC CNI Managed Add-on to `v1.22.4` or later.\n- Workaround until patched: avoid hyphens in namespace names.","status":"open","published_at":"2026-09-16T00:00:00+00:00","first_seen_at":"2026-10-24T18:56:55+00:00","triaged_at":"2026-10-25T05:30:31+00:00","updated_at":"2026-10-26T02:56:37+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T05:30:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Amazon EKS Network Policy Agent to `1.4.0` or later.\n- Upgrade the Amazon VPC CNI Managed Add-on to `v1.22.4` or later.\n- Workaround until patched: avoid hyphens in namespace names.","reach":"network","title":"Amazon EKS: pod identifier collision lets NetworkPolicy be bypassed across namespaces","impact":"medium","summary":"The EKS Network Policy Agent builds pod identifiers by joining pod name and namespace with a hyphen, so pods in different namespaces can get the same identifier. This can let traffic bypass NetworkPolicy enforcement between namespaces.","category":"infrastructure","nicknames":[],"who_cares":["aws","eks","kubernetes","vpc-cni","network-policy"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Network traffic bypasses NetworkPolicy isolation between namespaces in the cluster.","analyst_note":"","how_to_check":"- Check the Network Policy Agent version in the cluster, for example `kubectl get daemonset aws-node -n kube-system -o jsonpath='{.spec.template.spec.containers[*].image}'`, and compare against `1.4.0`.\n- Check the VPC CNI managed add-on version in the EKS console or with `aws eks describe-addon --cluster-name <cluster> --addon-name vpc-cni`, and compare against `v1.22.4`.\n- List namespaces containing hyphens with `kubectl get namespaces -o name | grep -- '-'` and check whether NetworkPolicies rely on namespace isolation.","needs_analyst":false,"not_affected_if":["no-network-policy-agent","no-hyphenated-namespaces"],"who_is_affected":"Clusters running the aws-network-policy-agent on Amazon EKS with NetworkPolicy enforcement, where the VPC CNI managed add-on is in the affected version range (1.14.0 up to 1.22.3). The ambiguity needs hyphenated pod and namespace names that collide, so clusters that enforce isolation through NetworkPolicy and have hyphenated namespaces are the ones to check first. Clusters not using the network policy agent can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000804,"input_tokens":3959,"output_tokens":816,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113':117C '-2026':2A,79C,97C,146C,295C '-86831':3A,80C,98C,147C,296C '09/16/2026':128C '1.14.0':215C '1.22.3':216C '1.4.0':242C '12':129C '2026':116C '30':130C '3j25':301C '7xv7':299C '8r3j':300C 'across':203C,291C 'add':222C,251C 'add-on':221C,250C 'agent':15A,46B,92C,110C,136C,159C,164C,227C,241C 'allow':207C 'amazon':17A,94C,112C,155C,217C,237C,246C 'ambigu':196C,278C 'attent':125C 'avoid':272C 'aw':12A,29B,89C,107C,118C,120C,161C 'aws-network-policy-ag':11A,88C,106C,160C 'aws-security@amazon.com':309C 'build':47B 'bulletin':114C 'bypass':73B,153C,212C 'c7mx':22A,27A,305C 'charact':186C 'cni':41B,219C,248C 'concaten':172C 'concern':315C 'construct':170C,282C 'contain':269C 'content':121C 'cross':150C 'cross-namespac':149C 'custom':257C 'cve':1A,78C,96C,145C,294C 'date':127C 'defin':263C 'delimit':181C 'descript':133C 'differ':62B,204C 'disclosur':35B 'ek':18A,30B,43B,95C,113C,139C,156C,238C 'elimin':284C 'email':308C 'enforc':75B,209C 'ensur':285C 'featur':142C 'get':65B 'ghsa':20A,25A,298C,303C 'ghsa-7xv7-8r3j-3j25':297C 'ghsa-gjc7-c7mx-x8f3':19A,24A,302C 'gjc7':21A,26A,304C 'hyphen':58B,180C,270C,273C 'id':115C 'ident':199C 'identifi':8A,49B,68B,85C,103C,144C,168C,200C,281C,288C 'impact':213C 'import':123C 'improp':4A,81C,99C 'infrastructur':31B 'issu':232C,261C 'join':51B 'kubernet':32B,189C 'lab':34B 'lab-disclosur':33B 'later':244C,255C 'legal':185C 'let':71B 'manag':141C,220C,249C 'mitig':259C 'name':53B,175C,191C,194C,265C,276C 'namespac':55B,63B,77B,151C,177C,193C,205C,264C,275C,292C 'network':13A,37B,44B,90C,108C,134C,157C,162C,225C,239C 'network-polici':36B 'networkpolici':74B,152C,208C 'pdt':132C 'pleas':307C 'pm':131C 'pod':7A,48B,52B,60B,84C,102C,167C,174C,190C,202C,287C 'polici':14A,38B,45B,91C,109C,135C,140C,158C,163C,226C,240C 'potenti':206C 'produc':198C 'public':126C 'question':313C 'refer':293C 'remain':289C 'remedi':230C 'requir':124C 'resolut':228C 'scope':119C 'secur':312C 'traffic':72B 'type':122C 'uniqu':9A,86C,104C,290C 'upgrad':235C 'user':233C 'v1.22.4':253C 'v1.4.0':166C,224C 'valid':5A,82C,100C 'version':214C 'vpc':40B,218C,247C 'vpc-cni':39B 'workaround':256C 'x8f3':23A,28A,306C","nicknames":[],"mitigations":[{"kind":"workaround","scope":"Amazon EKS Network Policy Agent (aws-network-policy-agent)","since":null,"covers":"Pod identifier collisions across namespaces caused by the hyphen delimiter, by avoiding hyphens in namespace names","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/","vendor":"Team","seen_at":"2026-10-26T02:56:37Z","confidence":0.8,"source_title":"CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS","customer_action":"Define namespace names that do not contain hyphens (-) until upgrading to Network Policy Agent 1.4.0 or later and VPC CNI Managed Add-on v1.22.4 or later"}],"who_affected":"Clusters running the aws-network-policy-agent on Amazon EKS with NetworkPolicy enforcement, where the VPC CNI managed add-on is in the affected version range (1.14.0 up to 1.22.3). The ambiguity needs hyphenated pod and namespace names that collide, so clusters that enforce isolation through NetworkPolicy and have hyphenated namespaces are the ones to check first. Clusters not using the network policy agent can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-16T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/#GHSA-gjc7-c7mx-x8f3","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/","severity":null,"published_at":"2026-09-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:55+00:00","fetched_at":"2026-10-26T02:59:31+00:00","note":"AWS: CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS"}],"documents":[{"id":2914,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/","title":"AWS: CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS","kind":"advisory","source":"lab","text":"CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS\n\n### CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS\n\nBulletin ID: 2026-113-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/16/2026 12:30 PM PDT\n\nDescription:\n\nNetwork Policy Agent is an EKS Policy management feature. We identified CVE-2026-86831, a cross-namespace NetworkPolicy bypass in Amazon EKS Network Policy Agent (aws-network-policy-agent) before v1.4.0. Pod identifiers are constructed by concatenating the pod name and namespace with a hyphen delimiter, which is a legal character in both Kubernetes pod names and namespace names. This ambiguity can produce identical identifiers for pods across different namespaces, potentially allowing NetworkPolicy enforcement to be bypassed.\n\nImpacted versions:\n\n- 1.14.0<1.22.3 Amazon VPC CNI Managed Add-on\n- < v1.4.0 Network Policy Agent\n\nResolution:\n\nTo remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later.\n\nWorkarounds:\n\nCustomers can mitigate this issue by defining namespace names that do not contain hyphens (-). By avoiding hyphens in namespace names, the ambiguity in the identifier construction is eliminated, ensuring that pod identifiers remain unique across namespaces.\n\nReferences:\n\n- CVE-2026-86831\n- GHSA-7xv7-8r3j-3j25\n- GHSA-gjc7-c7mx-x8f3\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-09-16T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}