{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-122266","assignerOrgId":"ff89ba41-3aa1-4d27-914a-91399e9639e5","state":"PUBLISHED","assignerShortName":"AMZN","dateReserved":"2026-11-04T21:31:28.131Z","datePublished":"2026-11-04T21:44:07.128Z","dateUpdated":"2026-11-06T13:35:41.877Z"},"containers":{"cna":{"providerMetadata":{"orgId":"ff89ba41-3aa1-4d27-914a-91399e9639e5","shortName":"AMZN","dateUpdated":"2026-11-06T13:35:41.877Z"},"title":"Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-1189","description":"CWE-1189 Improper isolation of shared resources on System-on-a-Chip (SoC)","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-180","descriptions":[{"lang":"en","value":"CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}],"affected":[{"vendor":"AWS","product":"aws-network-policy-agent","versions":[{"status":"affected","version":"0","lessThan":"1.3.7","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"AWS","product":"amazon-vpc-cni-k8s","versions":[{"status":"affected","version":"0","lessThan":"1.22.3","versionType":"custom"}],"defaultStatus":"unaffected"}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:aws:aws-network-policy-agent:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"1.3.7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:aws:amazon-vpc-cni-k8s:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"1.22.3"}]}]}],"descriptions":[{"lang":"en","value":"Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AF_PACKET frames.\n\n\n\nTo remediate this issue, users should upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later (which includes Network Policy Agent v1.3.7).","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AF_PACKET frames.</p><p>To remediate this issue, users should upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later (which includes Network Policy Agent v1.3.7).</p>"}]}],"references":[{"url":"https://github.com/aws/aws-network-policy-agent/releases/tag/v1.3.7","tags":["release-notes","patch"]},{"url":"https://github.com/aws/amazon-vpc-cni-k8s/releases/tag/v1.22.3","tags":["release-notes","patch"]},{"url":"https://aws.amazon.com/security/security-bulletins/2026-170-aws/","tags":["vendor-advisory"]},{"url":"https://github.com/aws/aws-network-policy-agent/security/advisories/GHSA-mm5f-ggvx-hmvw","tags":["third-party-advisory"]},{"url":"https://github.com/aws/amazon-vpc-cni-k8s/security/advisories/GHSA-rp3x-m95q-87mx","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseSeverity":"HIGH","baseScore":8.7,"vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","subIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":6.3,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.5.0"}}}}