CVE-2026-122266

High

Description

Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AF_PACKET frames. To remediate this issue, users should upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later (which includes Network Policy Agent v1.3.7).

SeverityHigh

CVSS8.7

Exploit probability—

ProductAws-network-policy-agent

PublishedNov 4, 2026

First seenNov 4, 2026

Weakness typeCWE-1189CWE-1189

How to fix

Update

AWS aws-network-policy-agent1.3.7 or later
AWS amazon-vpc-cni-k8s1.22.3 or later

Patches

Vendor advisories

aws.amazon.com/security/security-bulletins/2026-170-aws/

Affected products

Product	Affected versions	Fixed in
AWS aws-network-policy-agent	v < 1.3.7	1.3.7
AWS amazon-vpc-cni-k8s	v < 1.22.3	1.22.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.