CVE-2026-86831CWE-1289

CVE-2026-86831

High · published September 17, 2026

CVSS v3.1
8.7
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod identifier collisions.

To remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later (which includes Network Policy Agent v1.4.0).

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS
0.00643 · 50.2th percentile
Weakness
CWE-1289 · Improper Validation of Unsafe Equivalence in Input
Published
2026-09-17T00:17Z
References (5)
https://aws.amazon.com/security/security-bulletins/2026-113-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/amazon-vpc-cni-k8s/releases/tag/v1.22.4 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/amazon-vpc-cni-k8s/security/advisories/GHSA-gjc7-c7mx-x8f3 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/aws-network-policy-agent/releases/tag/v1.4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/aws-network-policy-agent/security/advisories/GHSA-7xv7-8r3j-3j25 · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 19:49Z
    Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS
    cvelistv5