Cloud service vulnerability, severity medium

Amazon EKS Network Policy Agent flaw (CVE-2026-122266) lets adjacent users bypass NetworkPolicy ingress rules

Published November 4, 2026

Improper isolation of shared eBPF connection tracking state in aws-network-policy-agent might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods in Amazon EKS. Affected are aws-network-policy-agent versions before 1.3.7 and the Amazon VPC CNI Managed Add-on versions before 1.22.3. No workarounds are available.

What's affected

• aws eks kubernetesevery version

What to do

1. Upgrade aws-network-policy-agent to version 1.3.7 or later
2. Upgrade the Amazon VPC CNI Managed Add-on to version 1.22.3 or later
3. Make sure any forked or derivative code includes the fixes
4. No workarounds are available, so patching is the only mitigation

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident aws-eks-network-policy-agent-isolation-2026-11

References

• https://aws.amazon.com/security/security-bulletins/rss/2026-170-aws/

Notice aws-eks-network-policy-agent-isolation-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.