High severity8.7NVD Advisory· Published Nov 4, 2026

CVE-2026-122266

Description

Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AF_PACKET frames.

To remediate this issue, users should upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later (which includes Network Policy Agent v1.3.7).

Affected products

Amazon/VPC CNIllm-create
Range: <1.22.3
AWS/amazon-vpc-cni-k8sllm-create
Range: <1.22.3
AWS/aws-network-policy-agentllm-create
Range: <1.3.7
Amazon/aws-network-policy-agentllm-fuzzy
Range: <1.3.7

Patches

Vulnerability mechanics

References

aws.amazon.com/security/security-bulletins/2026-170-aws/nvd
github.com/aws/amazon-vpc-cni-k8s/releases/tag/v1.22.3nvd
github.com/aws/aws-network-policy-agent/releases/tag/v1.3.7nvd
github.com/aws/aws-network-policy-agent/security/advisories/GHSA-mm5f-ggvx-hmvwnvd

News mentions

No linked articles in our index yet.

cvss	0.565
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000