Database/Container, Kubernetes & orchestration

EKS Network Policy Agent: crafted AF_PACKET frames poison the eBPF conntrack map and bypass NetworkPolicy ingress

CVSS 6.3CVE-2026-122266Container, Kubernetes & orchestrationcurated

Impact

A pod on the node can forge entries in the shared eBPF conntrack map that the Network Policy Agent uses to decide whether ingress is already-established, and thereby reach co-located pods that NetworkPolicy was supposed to isolate. On a GPU cluster this is the control that keeps one tenant's training or inference pods from talking to another's on the same node, and GPU nodes are densely packed, so the set of reachable neighbours is large. The agent's map is per-node shared state, so a single compromised or hostile workload defeats enforcement for every pod scheduled beside it. AWS scores the scope change as high confidentiality and integrity impact on the subsequent system, with no direct impact on the agent itself.

Who can reach it

An authenticated, adjacent attacker - in practice anyone who can run a pod on the node (or sit on the same L2 segment) and emit raw AF_PACKET frames. No cluster-admin rights needed.

What to do

Upgrade the Amazon VPC CNI managed add-on to v1.22.3 or later, which bundles Network Policy Agent v1.3.7. The add-on rolls as a DaemonSet, so the agent pods restart node by node; workloads stay up but network-policy enforcement is briefly in flux during the roll. No node drain or reboot is required.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-122266 https://aws.amazon.com/security/security-bulletins/2026-170-aws/https://github.com/aws/aws-network-policy-agent/security/advisories/GHSA-mm5f-ggvx-hmvw https://github.com/aws/amazon-vpc-cni-k8s/releases/tag/v1.22.3

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.