Amazon EKS Network Policy Agent <=1.3.7 eBPF conntrack map poisoning
CVE-2026-122266 Published on November 4, 2026

Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS
Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AF_PACKET frames. To remediate this issue, users should upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later (which includes Network Policy Agent v1.3.7).

Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

What is a SoC Vulnerability?

The product does not properly isolate shared resources between trusted and untrusted agents.

CVE-2026-122266 has been classified to as a SoC vulnerability or weakness.


Products Associated with CVE-2026-122266

stack.watch emails you whenever new vulnerabilities are published in Aws Network Policy Agent or Aws Amazon Vpc Cni K8s. Just hit a watch button to start following.

Aws Network Policy Agent
 
Aws Amazon Vpc Cni K8s
 

Affected Versions

aws-network-policy-agent: AWS amazon-vpc-cni-k8s: