CVE-2026-122192 - Guest Access to Firecracker Process Memory After a Failed Memory Discard
CVE-2026-122192
Summary
Bulletin ID: 2026-170-AWS
Publication Date: 11/04/2026 13:30 PM PST
Description:
We identified CVE-2026-122266, an issue in Amazon EKS Network Policy Agent (aws-network-policy-agent). Improper isolation of shared eBPF connection tracking state might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods.
Impacted versions:
- aws-network-policy-agent < 1.3.7
- Amazon VPC CNI Managed Add-on < 1.22.3
Refer to the article below for the most up-to-date and complete information.
Read this article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.