In plain language
What this advisory means
Amazon EKS had a security issue in its Network Policy Agent that could allow network policies to be bypassed across different Kubernetes namespaces. This happened because pod identifiers were created by joining pod names and namespaces using a hyphen. Since both pod names and namespaces can legally contain hyphens, this method could cause identifier confusion between pods in different namespaces. Updating to version 1.4.0 or later of the Network Policy Agent fixes this problem.
Technical explanation
How the issue affects the environment
The vulnerability CVE-2026-86831 involves improper validation of pod identifier uniqueness in the aws-network-policy-agent component of Amazon EKS. The agent constructs pod identifiers by concatenating pod names and namespaces with a hyphen delimiter. Since Kubernetes pod and namespace names are allowed to contain hyphens, this concatenation can produce non-unique identifiers for pods in separate namespaces. This ambiguity enables a cross-namespace NetworkPolicy bypass, potentially allowing network traffic that should be restricted to occur. The issue is resolved by upgrading aws-network-policy-agent to version 1.4.0 or later and the Amazon VPC CNI Managed Add-on to version 1.22.4 or later. As a workaround, users can avoid hyphens in namespace names to prevent identifier collisions.
Operational impact
Why teams should care
If exploited, this vulnerability could allow malicious actors or misconfigured workloads to bypass network policies designed to restrict cross-namespace communications. This undermines the security of workloads running in Amazon EKS clusters, potentially exposing sensitive applications and data to unauthorized network access, leading to compliance risks, data breaches, and operational disruptions.
Immediate action
Upgrade aws-network-policy-agent to version 1.4.0 or later and Amazon VPC CNI Managed Add-on to version 1.22.4 or later to prevent the NetworkPolicy bypass issue.
Affected and fixed releases
Temporary risk reduction
Avoid using hyphens (-) in Kubernetes namespace names to eliminate ambiguity in pod identifier construction and maintain uniqueness across namespaces.
Evidence and validation checklist
- AWS Security Bulletin 2026-113-AWS published 2026-09-16
- Description of CVE-2026-86831 explaining concatenation ambiguity and resulting NetworkPolicy bypass
- Listing of affected and fixed versions
- Recommended remediation steps and workaround for namespace naming
Authoritative reference
AWS Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.