AWS flags CVE-2026-122266, a NetworkPolicy bypass in the Amazon EKS network policy agent
VULNERABILITYCVE-2026-122266redteam/daily · 1 source
- Severity
- Medium
- Highest CVSS
- 6.3
- Exploited
- Not known
- Sources
- 1
What happened
AWS has published bulletin 2026-170-AWS for CVE-2026-122266, improper isolation of shared eBPF connection tracking state in aws-network-policy-agent on Amazon EKS. An authenticated adjacent user could bypass NetworkPolicy ingress enforcement on co-located pods. Affected components are aws-network-policy-agent before 1.3.7 and the Amazon VPC CNI Managed Add-on before 1.22.3.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Check the aws-network-policy-agent version and update it to 1.3.7 or later.
- Check the Amazon VPC CNI Managed Add-on version and update it to 1.22.3 or later.
- Review the AWS bulletin 2026-170-AWS for complete remediation information.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
AWS Security Bulletins