AWS flags CVE-2026-122266, a NetworkPolicy bypass in the Amazon EKS network policy agent
VULNERABILITYCVE-2026-122266redteam/daily · 1 source
- Severity
- Medium
- Highest CVSS
- 6.3
- Exploited
- Not known
- Sources
- 1
What happened
CVE-2026-122266 is an improper isolation of shared resources issue (eBPF connection tracking state) in aws-network-policy-agent, affecting Amazon EKS. An authenticated adjacent user may bypass NetworkPolicy ingress enforcement on co-located pods. Affected: aws-network-policy-agent before 1.3.7 and Amazon VPC CNI Managed Add-on before 1.22.3. Defenders should check their agent and add-on versions and update to at least 1.3.7 and 1.22.3, and review the AWS bulletin 2026-170-AWS for full details.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check the aws-network-policy-agent version and update it to 1.3.7 or later.
- Check the Amazon VPC CNI Managed Add-on version and update it to 1.22.3 or later.
- Review the AWS bulletin 2026-170-AWS for complete remediation information.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
AWS Security Bulletins