CVE-2026-86831
High
Description
Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod identifier collisions. To remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later (which includes Network Policy Agent v1.4.0).
SeverityHigh
CVSS8.7
Exploit probability51. percentile0.6%
ProductAws-network-policy-agent
PublishedSep 16, 2026
First seenSep 16, 2026
Weakness typeCWE-1289CWE-1289
How to fix
Update
- AWS aws-network-policy-agent1.4.0 or later
- AWS amazon-vpc-cni-k8s1.22.4 or later
Patches
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| AWS aws-network-policy-agent | v < 1.4.0 | 1.4.0 |
| AWS amazon-vpc-cni-k8s | 1.14.0 ≤ v < 1.22.4 | 1.22.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.