CVE-2026-86831
Description
A flaw was found in the aws-network-policy-agent. An authenticated remote user could exploit improper validation of pod identifier uniqueness by crafting specific pod and namespace names. This allows them to bypass NetworkPolicy enforcement on co-located pods in other namespaces, potentially leading to unauthorized network access.
Statement
Red Hat has classified this vulnerability as having an Important severity impact because breaking inter-namespace traffic restrictions compromises multi-tenant isolation, although it requires high privileges to deploy workloads with collision-inducing metadata. Red Hat Enterprise Linux and OpenShift environments, including Red Hat OpenShift Service on AWS (ROSA), are not affected as they do not package or deploy the Amazon EKS Network Policy Agent, relying instead on network plugins such as OVN-Kubernetes.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
If the product assumes that each resource has a unique identifier, the product could operate on the wrong resource if attackers can cause multiple resources to be associated with the same identifier.
Access Control
Technical Impact: Bypass Protection Mechanism
If unique identifiers are assumed when protecting sensitive resources, then duplicate identifiers might allow attackers to bypass the protection.
Other
Technical Impact: Quality Degradation
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
