CVE-2026-86831 Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS
Authenticated users can bypass NetworkPolicy enforcement on co-located pods in other namespaces by exploiting pod identifier collisions in the AWS Network Policy Agent.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86831?
CVE-2026-86831 is a high-severity vulnerability in AWS amazon-vpc-cni-k8s, published on 16 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod identifier collisions.
To remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later (which includes Network Policy Agent v1.4.0).
Weakness: CWE-1289
Which versions are affected by CVE-2026-86831?
How do I fix CVE-2026-86831?
No fix has been published for CVE-2026-86831 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-86831 being exploited?
There is no known exploitation of CVE-2026-86831 in the wild and no public exploit code.