CVE-2026-122266mediumCWE-1189

CVE-2026-122266: medium-severity vulnerability in aws-network-policy-agent

Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS

Published · Updated

Follow this CVE+ Monitor amazon-vpc-cni-k8s+ Monitor aws-network-policy-agent

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.3%
Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AF_PACKET frames. To remediate this issue, users should upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later (which includes Network Policy Agent v1.3.7).
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Affected products
AWS · amazon-vpc-cni-k8sAWS · aws-network-policy-agent
Related CVEs — aws-network-policy-agent

In the same product, most dangerous first.

CVE-2026-86831HIGHImproper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKSEPSS 0.6%