Executive brief
Amazon EKS Network Policy Agent enforces network access controls (NetworkPolicies) in Kubernetes clusters. Due to improper pod identifier validation, an attacker could craft pod names and namespaces that produce identical identifiers, bypassing network policy enforcement and allowing unauthorized traffic between isolated workloads across different namespaces.
Technical details
The vulnerability is rooted in improper validation of pod identifier uniqueness in the aws-network-policy-agent component. Pod identifiers are constructed by concatenating the pod name and namespace separated by a hyphen delimiter. Since hyphens are valid characters in both Kubernetes pod names and namespace names, this construction method can produce identical identifiers for different pods in different namespaces (e.g., "pod-a" in namespace "b" collides with "pod" in namespace "a-b"). An attacker with the ability to create pods in multiple namespaces can exploit this collision to bypass NetworkPolicy enforcement and send traffic between namespaces that should be isolated. The vulnerability affects versions before v1.4.0 of aws-network-policy-agent and Amazon VPC CNI versions before 1.22.3. A fix is available in v1.4.0 and later.
Affected products
- Amazon EKS aws-network-policy-agent < 1.4.0
- Amazon VPC CNI Managed Add-on 1.14.0 to < 1.22.3
Timeline
- 2026-09-16: disclosed: CVE-2026-86831 disclosed in AWS Security Bulletin 2026-113-AWS