CVE-2026-86831: NetworkPolicy Bypass in AWS EKS Network Policy Agent

aws-network-policy-agent versions before v1.4.0 have a nasty cross-namespace NetworkPolicy bypass. The vulnerability stems from how pod identifiers are built—concatenating pod names and namespaces with hyphens, which are legal characters in both. This creates ambiguous identifiers that can match pods across different namespaces, potentially letting attackers bypass network policies. If you're running Amazon EKS with Network Policy Agent < v1.4.0 or Amazon VPC CNI < 1.22.3, you need to update immediately.