---
id: "GHSA-gjc7-c7mx-x8f3"
kind: "vulnerability"
aliases: ["GHSA-gjc7-c7mx-x8f3"]
title: "CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aws", "eks", "infrastructure", "kubernetes", "lab-disclosure", "network-policy", "vpc-cni"]
not_affected_if: ["no-hyphenated-namespaces", "no-network-policy-agent"]
published_at: "2026-09-16T00:00:00+00:00"
first_seen_at: "2026-10-24T18:56:55+00:00"
updated_at: "2026-10-26T02:56:37+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/", "first_seen_at": "2026-10-24T18:56:55+00:00"}]
---

# CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

The EKS Network Policy Agent builds pod identifiers by joining pod name and namespace with a hyphen, so pods in different namespaces can get the same identifier. This can let traffic bypass NetworkPolicy enforcement between namespaces.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Network Policy Agent version in the cluster, for example `kubectl get daemonset aws-node -n kube-system -o jsonpath='{.spec.template.spec.containers[*].image}'`, and compare against `1.4.0`.
- Check the VPC CNI managed add-on version in the EKS console or with `aws eks describe-addon --cluster-name <cluster> --addon-name vpc-cni`, and compare against `v1.22.4`.
- List namespaces containing hyphens with `kubectl get namespaces -o name | grep -- '-'` and check whether NetworkPolicies rely on namespace isolation.

## Fix

- Upgrade Amazon EKS Network Policy Agent to `1.4.0` or later.
- Upgrade the Amazon VPC CNI Managed Add-on to `v1.22.4` or later.
- Workaround until patched: avoid hyphens in namespace names.

## Mitigated for you by

- Team (workaround): covers Pod identifier collisions across namespaces caused by the hyphen delimiter, by avoiding hyphens in namespace names Limits: none stated Still: Define namespace names that do not contain hyphens (-) until upgrading to Network Policy Agent 1.4.0 or later and VPC CNI Managed Add-on v1.22.4 or later https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/

## Timeline

- 2026-10-24T18:56:55+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/ — AWS: CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

## Documents

- [advisory] AWS: CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS https://aws.amazon.com/security/security-bulletins/rss/2026-113-aws/

## From the sources

CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

### CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

Bulletin ID: 2026-113-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/16/2026 12:30 PM PDT

Description:

Network Policy Agent is an EKS Policy management feature. We identified CVE-2026-86831, a cross-namespace NetworkPolicy bypass in Amazon EKS Network Policy Agent (aws-network-policy-agent) before v1.4.0. Pod identifiers are constructed by concatenating the pod name and namespace with a hyphen delimiter, which is a legal character in both Kubernetes pod names and namespace names. This ambiguity can produce identical identifiers for pods across different namespaces, potentially allowing NetworkPolicy enforcement to be bypassed.

Impacted versions:

- 1.14.0<1.22.3 Amazon VPC CNI Managed Add-on
- < v1.4.0 Network Policy Agent

Resolution:

To remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later.

Workarounds:

Customers can mitigate this issue by defining namespace names that do not contain hyphens (-). By avoiding hyphens in namespace names, the ambiguity in the identifier construction is eliminated, ensuring that pod identifiers remain unique across namespaces.

References:

- CVE-2026-86831
- GHSA-7xv7-8r3j-3j25
- GHSA-gjc7-c7mx-x8f3

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_