Read the docs
TI-2026-85231 Aliases CVE-2026-122266

Network policy ingress bypass in Amazon EKS network policy agent

Priority LOW 28CWE-1189Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The aws-network-policy-agent before 1.3.7 and amazon-vpc-cni-k8s before 1.22.3 in Amazon EKS are affected. Improper isolation of shared resources (CWE-1189) lets an authenticated adjacent user with low privileges bypass NetworkPolicy ingress enforcement on co-located pods. The attacker does this by corrupting the eBPF conntrack map.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AF_PACKET frames. To remediate this issue, users should upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later (which includes Network Policy Agent v1.3.7).

Why it matters now

EPSS 0.00272 19th percentileScored 2026-11-07
Fix Fixed aws-network-policy-agent (AWS): 1.3.7amazon-vpc-cni-k8s (AWS): 1.22.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSaws-network-policy-agentbefore 1.3.71.3.7Patch availableCNA
AWSamazon-vpc-cni-k8sbefore 1.22.31.22.3Patch availableCNA
  • aws-network-policy-agent VendorAWS Affected before 1.3.7 Fixed in 1.3.7 Patch available CNA
  • amazon-vpc-cni-k8s VendorAWS Affected before 1.22.3 Fixed in 1.22.3 Patch available CNA

Remediation

Upgrade aws-network-policy-agent to 1.3.7 or later and amazon-vpc-cni-k8s to 1.22.3 or later. Amazon VPC CNI Managed Add-on v1.22.3 or later includes Network Policy Agent v1.3.7.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA aws-network-policy-agent (AWS) Fixed in 1.3.7
  • Fix · CNA amazon-vpc-cni-k8s (AWS) Fixed in 1.22.3

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122266
  2. 2026-11-04 1 new reference · CNA
  3. 2026-11-06 Priority changed: MEDIUM → LOW
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat
  6. 2026-11-06 1 new reference · CNA

References

Patch 2

Advisory 3

  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2024-18648 Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM… CVSS 3.1CRITICAL 9.8
  • TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
  • TI-2025-03847 Input validation issue in AWS Amplify Studio UI component properties CVSS 4.0CRITICAL 9.0
  • TI-2026-11603 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF CVSS 4.0HIGH 7.9
See all 383 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences