aws aws-network-policy-agent CVE-2026-86831 in Aws and Amazon Products
Published on September 16, 2026

Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

product logo product logo
Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod identifier collisions. To remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later (which includes Network Policy Agent v1.4.0).

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-86831 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

Improper Validation of Unsafe Equivalence in Input

The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.


Products Associated with CVE-2026-86831

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-86831 are published in these products:

Aws Network Policy Agent
 
Aws Amazon Vpc Cni K8s
 
Amazon Aws
 

Affected Versions

aws-network-policy-agent: AWS amazon-vpc-cni-k8s: