---
id: "GHSA-mm5f-ggvx-hmvw"
kind: "vulnerability"
aliases: ["GHSA-mm5f-ggvx-hmvw"]
title: "CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aws", "eks", "infrastructure", "kubernetes", "lab-disclosure", "network-policy", "vpc-cni"]
not_affected_if: ["fixed-version", "no-network-policy"]
published_at: null
first_seen_at: "2026-11-04T22:11:43+00:00"
updated_at: "2026-11-04T22:14:46+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-170-aws/", "first_seen_at": "2026-11-04T22:11:43+00:00"}]
exploit_sources: []
---

# CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS

The aws-network-policy-agent component of Amazon EKS, which enforces Kubernetes NetworkPolicy, has improper isolation of shared eBPF connection tracking state. An authenticated user on an adjacent pod can bypass NetworkPolicy ingress enforcement on co-located pods.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the version of aws-network-policy-agent running in the cluster and compare it with `1.3.7`.
- Check the Amazon VPC CNI Managed Add-on version and compare it with `1.22.3`.
- Check whether the cluster uses forked or derivative code of the network policy agent.

## Fix

- aws-network-policy-agent: move to `1.3.7` or later.
- Amazon VPC CNI Managed Add-on: move to `1.22.3` or later.

## Timeline

- 2026-11-04T22:11:43+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-170-aws/ — AWS: CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS

## Documents

- [advisory] AWS: CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS https://aws.amazon.com/security/security-bulletins/rss/2026-170-aws/

## From the sources

CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS

### CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS

Bulletin ID: 2026-170-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/04/2026 13:30 PM PST

Description:

Amazon EKS Network Policy Agent (aws-network-policy-agent) is an open-source component of the Amazon VPC CNI that enforces Kubernetes NetworkPolicy on Amazon EKS clusters.

We identified CVE-2026-122266, an issue in Amazon EKS Network Policy Agent (aws-network-policy-agent). Improper isolation of shared eBPF connection tracking state might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods.

Impacted versions:

- aws-network-policy-agent < 1.3.7
- Amazon VPC CNI Managed Add-on < 1.22.3

Resolution:

This issue has been addressed in aws-network-policy-agent versions 1.3.7 and amazon-vpc-cni-k8s version 1.22.3. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There are no workarounds available.

References:

- CVE-2026-122266
- GHSA-mm5f-ggvx-hmvw

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_