A vulnerability in the AWS Network Policy Agent allows authenticated remote users to bypass network security policies, potentially exposing sensitive inter-pod communications.

The flaw resides in the improper validation of pod identifiers, where crafted pod and namespace names cause identifier collisions. This allows an authenticated user with sufficient privileges to bypass defined NetworkPolicy enforcement mechanisms on co-located pods.

The vulnerability carries a CVSS score of 8.7, indicating high severity due to its potential to compromise network segmentation within a Kubernetes cluster. Successful exploitation permits unauthorized communication between pods that should otherwise be isolated, leading to potential data exfiltration or unauthorized access to internal services. This undermines the zero trust architecture of the affected EKS environments and poses a significant risk of lateral movement.

Immediate Action: Upgrade the Amazon EKS Network Policy Agent to version 1.4.0 or later, and update the Amazon VPC CNI Managed Add-on to version 1.22.4 or later.

Proactive Monitoring: Monitor Kubernetes audit logs for unusual pod creation patterns or repeated attempts to deploy pods with conflicting identifier structures.

Compensating Controls: While no direct WAF equivalent exists for internal pod-to-pod traffic, ensure that secondary network security layers, such as service mesh mTLS policies, are enforced to restrict unauthorized service communication.

Public Exploit Available: Unknown.

Given the high CVSS score and the critical nature of network segmentation in containerized environments, organizations should prioritize these updates during the next maintenance cycle. Failure to patch allows for the circumvention of established security boundaries, which could have severe implications for internal network integrity. Immediate deployment of the specified versions is the only effective way to remediate this identifier validation flaw.