Improper Resource Isolation in Amazon EKS Network Policy Agent
CVE-2026-122266

6.3MEDIUM

Key Information:

Vendor

Aws

Status
Aws-network-policy-agent
Amazon-vpc-cni-k8s
Vendor
CVE Published:
4 November 2026

What is CVE-2026-122266?

The Amazon EKS Network Policy Agent prior to version 1.3.7 is vulnerable due to improper isolation of shared resources. This flaw allows an authenticated adjacent user to potentially bypass NetworkPolicy ingress enforcement on co-located pods. By exploiting eBPF conntrack map poisoning through crafted AF_PACKET frames, attackers could manipulate network traffic. It is crucial for users to upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later to mitigate this risk.

Affected Version(s)

amazon-vpc-cni-k8s 0 < 1.22.3

aws-network-policy-agent 0 < 1.3.7

References

https://github.com/aws/aws-network-policy-agent/releases/...
release-notespatch
https://github.com/aws/amazon-vpc-cni-k8s/releases/tag/v1...
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.