Amazon EKS Network Policy Agent bypasses ingress blocking

Summary

An authenticated adjacent user in Amazon EKS Network Policy Agent and VPC CNI can bypass NetworkPolicy ingress enforcement. Pods running on the same node are affected.

Affected when

• Amazon EKS Network Policy Agent before 1.3.7
• VPC CNI before 1.22.3
• authenticated adjacent user with co-located pods

What to do

Upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later, which includes Network Policy Agent v1.3.7.

Update to at least the version for your product:

• aws-network-policy-agent 1.3.7 or later
• amazon-vpc-cni-k8s 1.22.3 or later

Products and platforms

• Linux
• amazon-vpc-cni-k8s
• aws-network-policy-agent

CVE IDs

• CVE-2026-122266 (opens in a new tab)

Sources

• Advisory: github.com (opens in a new tab) · github.com (opens in a new tab) · aws.amazon.com (opens in a new tab)
• Write-up: github.com (opens in a new tab) · github.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 21:44 UTC

First seen 2026-11-09 16:20 UTC