GHSA-mm5f-ggvx-hmvw · Infrastructure
NO FIX YET · SEE WHAT TO DO
The aws-network-policy-agent component of Amazon EKS, which enforces Kubernetes NetworkPolicy, has improper isolation of shared eBPF connection tracking state. An authenticated user on an adjacent pod can bypass NetworkPolicy ingress enforcement on co-located pods.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Amazon EKS clusters that use the VPC CNI network policy agent to enforce Kubernetes NetworkPolicy, where authenticated workloads share nodes with the pods being protected. Clusters on versions at or above the fixed releases, or without NetworkPolicy enforcement, are not affected. The sources do not say whether managed-only setups differ from self-managed forks beyond the advice to patch derivative code.
Not affected if fixed-version, no-network-policy
Who cares aws, eks, kubernetes, lab-disclosure, network-policy, vpc-cni
1.3.7.1.22.3.1.3.7 or later.1.22.3 or later.CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS
Bulletin ID: 2026-170-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/04/2026 13:30 PM PST
Description:
Amazon EKS Network Policy Agent (aws-network-policy-agent) is an open-source component of the Amazon VPC CNI that enforces Kubernetes NetworkPolicy on Amazon EKS clusters.
We identified CVE-2026-122266, an issue in Amazon EKS Network Policy Agent (aws-network-policy-agent). Improper isolation of shared eBPF connection tracking state might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods.
Impacted versions:
Resolution:
This issue has been addressed in aws-network-policy-agent versions 1.3.7 and amazon-vpc-cni-k8s version 1.22.3. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
There are no workarounds available.
References:
Please email aws-security@amazon.com with any security questions or concerns.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.