EUVD-2026-81088Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H because crafting colliding pod/namespace names needs authenticated naming control; AC:H for the collision condition; S:C as the impact crosses the namespace security boundary; no availability impact.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
5DescriptionCVE.org
Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod identifier collisions.
To remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later (which includes Network Policy Agent v1.4.0).
AnalysisAI
Namespace isolation bypass in AWS Network Policy Agent (aws-network-policy-agent) before v1.4.0 lets an authenticated, highly privileged cluster user defeat NetworkPolicy enforcement against co-located pods that live in other namespaces. The attacker must be able to create pods and control their pod and namespace names so that they generate a pod identifier that collides with the identifier of a victim pod already running on the same node, which then causes the agent to misattribute enforcement state and skip the intended isolation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires Amazon EKS Network Policy enforcement to be ENABLED (opt-in; if you do not use Network Policy the flaw does not affect you, per the vendor release note) and a running Network Policy Agent before v1.4.0 / VPC CNI before v1.22.4. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional-privilege issue rather than a mass-exploitation threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Amazon EKS Network Policy Agent 1.4.0 or later, or to Amazon VPC CNI Managed Add-on v1.22.4 or later, which bundles Network Policy Agent v1.4.0 (https://github.com/aws/aws-network-policy-agent/releases/tag/v1.4.0 and https://github.com/aws/amazon-vpc-cni-k8s/releases/tag/v1.22.4). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every EKS cluster running the AWS Network Policy Agent and the Amazon VPC CNI Managed Add-on, and flag any cluster with Network Policy enabled on an agent version below v1.4.0 as exposed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Share
External POC / Exploit Code
Leaving vuln.today