AWS fixes EKS network policy bypass and a Firecracker memory flaw

AWS fixes EKS network policy bypass and a Firecracker memory flaw

4 November 2026: AWS published two security bulletins on 4 November. The one most EKS customers need to act on, 2026-170, covers CVE-2026-122266 in the aws-network-policy-agent, the part of the Amazon VPC CNI that enforces Kubernetes NetworkPolicy: shared eBPF connection-tracking state "might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods". The second, 2026-169, fixes CVE-2026-122192 in Firecracker, the open-source microVM monitor, for one snapshot configuration. AWS rates both Important and gives no CVSS score.

A policy that stops at the node

Network policies are how many clusters keep workloads apart: the payments service accepts traffic only from the checkout pods, and nothing else on the cluster can reach it. The flaw sits in how the agent shares connection-tracking state in eBPF between pods on the same node. A user who already has a workload running beside the target can, in the right conditions, get traffic through an ingress rule that should have dropped it.

That makes it a problem for multi-tenant clusters and for any design that relies on policies rather than separate node groups or accounts to isolate sensitive services.

The fixed versions:

• aws-network-policy-agent 1.3.7;
• Amazon VPC CNI managed add-on 1.22.3, which carries it.

AWS lists no workaround, so the upgrade is the fix. Clusters that manage the VPC CNI as an EKS add-on update it through the add-on version; self-managed installs need the new image.

Firecracker snapshots and the balloon device

CVE-2026-122192 affects Firecracker 0.23.0 to 1.16.1. Under certain host memory conditions, a root user inside a guest can read or modify the memory of the Firecracker process on the host. It applies only to microVMs restored from a snapshot with the File memory backend and a balloon or virtio-mem device. AWS says its own services, Lambda among them, are not affected and need no customer action.

Teams that run Firecracker themselves, for sandboxes, CI runners or their own serverless platforms, should move to 1.16.2 or 1.17.0. AWS's interim advice is to restore snapshots with the Uffd memory backend; on kernels without the Linux 6.12 overcommit change, to use heuristic overcommit and keep the maximum discard size no larger than host RAM plus swap; and to keep the memory cgroup OOM killer on. It says these do not prevent every failure. The flaw was reported by Juan Pablo Martinez Kuhn of Coinspect.

Advisory identifiers

The bulletins point to GitHub advisories GHSA-mm5f-ggvx-hmvw for the network policy agent and GHSA-48ww-rqpp-2mgm for Firecracker. Neither bulletin mentions exploitation.

Related on TrustList:

• Linux kernel flaw lets a guest VM read and crash its host
• XSA-523: two grant copy flaws let a Xen guest read and write Dom0 memory

Sources

• AWS: Security Bulletin 2026-170-AWS, CVE-2026-122266 in aws-network-policy-agent (published 4 November 2026, 13:30 PST), 4 November 2026
• AWS: Security Bulletin 2026-169-AWS, CVE-2026-122192 in Firecracker (published 4 November 2026, 11:30 PST), 4 November 2026