CVE-2026-122266

Name of the Vulnerable Software and Affected Versions Amazon EKS Network Policy Agent versions prior to 1.3.7 Amazon VPC CNI versions prior to 1.22.3

Description Improper isolation of shared resources allows an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods. This is achieved through eBPF conntrack map poisoning using crafted AF PACKET frames. eBPF (Extended Berkeley Packet Filter) is a technology that allows programs to run in the Linux kernel without changing kernel source code or loading a kernel module, and conntrack (connection tracking) is a mechanism used to keep track of all network connections.

Recommendations Upgrade Amazon EKS Network Policy Agent to version 1.3.7 or later. Upgrade Amazon VPC CNI Managed Add-on to version 1.22.3 or later.