The vulnerability CVE-2026-86831 arises from improper validation of pod identifier uniqueness in the aws-network-policy-agent component of Amazon EKS Network Policy Agent versions prior to 1.4.0. An authenticated remote user can exploit this flaw by crafting pod and namespace names that produce collisions in pod identifiers, effectively bypassing NetworkPolicy enforcement on pods co-located in other namespaces. This bypass undermines Kubernetes network isolation controls, potentially allowing unauthorized network communication between pods that should be isolated. The vulnerability is addressed by upgrading to version 1.4.0 or later of the Network Policy Agent, or by updating the Amazon VPC CNI Managed Add-on to version 1.22.4 or later, which bundles the fixed agent.

Successful exploitation allows an authenticated remote user to bypass Kubernetes NetworkPolicy enforcement, potentially enabling unauthorized network access between pods across namespaces. This can lead to confidentiality and integrity violations within the cluster, as indicated by the CVSS vector (Confidentiality: High, Integrity: High, Availability: None). There is no known exploitation in the wild at this time.

A fix is available. Users should upgrade to Amazon EKS Network Policy Agent version 1.4.0 or later. Alternatively, upgrading the Amazon VPC CNI Managed Add-on to version 1.22.4 or later, which includes the patched Network Policy Agent, will remediate the vulnerability. Since this is a cloud service component, the vendor manages remediation for the cloud-hosted service, but customers running affected versions should apply these upgrades promptly.