AmazonAnalysisAWS resolves eBPF NetworkPolicy ingress bypass flaw in Amazon EKS
What happened.Amazon Web Services published security bulletin 2026-170-AWS detailing a resource isolation defect in the Amazon EKS Network Policy Agent.
Why it matters.Kubernetes network policies establish zero-trust boundaries within shared container clusters. When eBPF connection tracking tables fail to partition traffic state between co-located pods, low-privileged containers establish unauthorized sessions with internal services. DevOps teams running Amazon EKS must upgrade the Amazon VPC CNI add-on to version 1.22.3. Platform architects should restrict raw socket capabilities across container pods.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-122266, improper isolation in shared eBPF connection tracking state allows adjacent pods to bypass Kubernetes NetworkPolicy ingress enforcement.
- Conntrack poisoning: Adjacent workloads on co-located worker nodes can craft raw network frames to inject poisoned connection tracking entries into kernel maps.
- Isolation bypass: Untrusted container workloads evade network segmentation policies, routing traffic directly to restricted application pods.
- Affected packages: The defect impacts aws-network-policy-agent versions prior to 1.3.7 and Amazon VPC CNI releases below 1.22.3.
- Remediation updates: AWS published aws-network-policy-agent 1.3.7 and VPC CNI 1.22.3, instructing administrators to upgrade managed add-ons.