CVE-2026-86831
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod identifier collisions.
Risk Assessment
An authenticated user could bypass NetworkPolicy rules and gain network access to pods in other namespaces, violating cluster network isolation. This could lead to unauthorized access to data or services belonging to other teams in the EKS cluster.
Recommendation
Upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later, which includes Network Policy Agent v1.4.0. Until upgraded, verify that NetworkPolicy rules are correctly enforced between namespaces.
Other vulnerabilities in Amazon EKS Network Policy Agent
Original NVD description (English source)
Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod identifier collisions. To remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later (which includes Network Policy Agent v1.4.0).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS