CVE-2026-122266: Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS
Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AFPACKET frames.
To remediate this issue, users should upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later (which includes Network Policy Agent v1.3.7).
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon VPC CNI Managed Add-onto a version that resolves this vulnerability.Fixed in 1.22.3 - Upgrade
Upgrade
Network Policy Agentto a version that resolves this vulnerability.Fixed in 1.3.7
Event History
Frequently Asked Questions
Which environments are affected?
Amazon EKS clusters using an Amazon VPC CNI version before 1.22.3, which includes Network Policy Agent versions before 1.3.7, are affected.
What access does an attacker need?
An attacker must be an authenticated adjacent user and must be able to send crafted AF_PACKET frames. The attack targets NetworkPolicy ingress enforcement for co-located pods.
Is this limited to confidentiality impact?
No. The stated impact includes bypassing ingress NetworkPolicy enforcement and has high confidentiality and integrity impact, while availability impact is not indicated.
What should be done to remediate the issue?
Upgrade to Amazon VPC CNI Managed Add-on version 1.22.3 or later. This includes Network Policy Agent version 1.3.7.