{"id":"CVE-2026-122266","title":"Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS","summary":"Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-locat…","severity":"high","cvss":8.7,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-1189"],"vendor":"AWS","product":"aws-network-policy-agent","affected":["aws-network-policy-agent < 1.3.7","amazon-vpc-cni-k8s < 1.22.3"],"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T21:50:30.839Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-122266","references":[{"url":"https://github.com/aws/aws-network-policy-agent/releases/tag/v1.3.7"},{"url":"https://github.com/aws/amazon-vpc-cni-k8s/releases/tag/v1.22.3"},{"url":"https://aws.amazon.com/security/security-bulletins/2026-170-aws/"},{"url":"https://github.com/aws/aws-network-policy-agent/security/advisories/GHSA-mm5f-ggvx-hmvw"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.627Z","slug":"CVE-2026-122266","body":"## Overview\n\nImproper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AF_PACKET frames.\n\n\n\nTo remediate this issue, users should upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later (which includes Network Policy Agent v1.3.7).\n\n## Affected\n\n- `aws-network-policy-agent < 1.3.7`\n- `amazon-vpc-cni-k8s < 1.22.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}