Free AWS Security Whitepaper
    Toc Consulting Logo
    AWS Security Digest·Week 38 of 2026·Sep 14-20, 2026·3 items

    AWS Pushes Back the Shield Advanced Migration Deadline as an EKS NetworkPolicy Bug Surfaces

    AWS pushes back the Shield Advanced Layer-7 migration deadline, giving customers until January 29, 2027 to move off legacy automatic mitigation. Also this week: a cross-namespace NetworkPolicy bypass in Amazon EKS's Network Policy Agent, and a TLS certificate validation flaw in the AWS IoT Device SDK for Python.

    In this issue2high1info

    Highlights

    1 item
    $ tail -f /var/log/aws-security.log
    high/CVE/

    CVE-2026-86831: Cross-Namespace NetworkPolicy Bypass in Amazon EKS

    CVE-2026-86831Bulletin 2026-113-AWS

    The Amazon EKS Network Policy Agent constructs internal pod identifiers by joining the pod name and namespace with a hyphen. Because hyphens are valid characters in both Kubernetes pod names and namespace names, an authenticated user able to create pods or namespaces in the cluster can craft two different pods in two different namespaces that end up with colliding identifiers, bypassing NetworkPolicy enforcement as a result. As a workaround ahead of patching, AWS recommends avoiding hyphens in namespace names.

    Affects the Amazon VPC CNI Managed Add-on 1.14.0 through 1.22.3 and Network Policy Agent before 1.4.0; fixed in Network Policy Agent 1.4.0 and VPC CNI Managed Add-on 1.22.4.

    Affected
    • Amazon VPC CNI Managed Add-on 1.14.0-1.22.3
    • Network Policy Agent < 1.4.0
    Fixed In
    • Network Policy Agent 1.4.0
    • Amazon VPC CNI Managed Add-on 1.22.4
    EKSVPC CNI

    CVEs & Vulnerabilities

    1 item
    $ cat /var/reports/CVE_REPORT.txt
    high/CVE/

    CVE-2026-92943: AWS IoT Device SDK for Python Failed to Validate Server Certificate Hostnames

    CVE-2026-92943Bulletin 2026-114-AWS

    The MQTT client's TLS connection layer in the AWS IoT Device SDK for Python did not validate that the server certificate matched the AWS IoT Core endpoint hostname, allowing a network-positioned attacker to present a certificate from an unrelated host and potentially impersonate the endpoint, intercept device telemetry, and inject fraudulent MQTT messages. Both primary connection paths are affected: X.509 mutual authentication on port 8883 and WebSocket with SigV4 on port 443. No workaround is available for the default connection paths.

    Affects AWSIoTPythonSDK 1.5.3 through 1.6.0 on Python 3.7 and later; fixed in 1.6.1. Credited to George Chen via coordinated disclosure.

    Affected
    • AWSIoTPythonSDK 1.5.3-1.6.0
    Fixed In
    • AWSIoTPythonSDK 1.6.1
    IoT Core

    Service Updates

    1 item
    $ aws securityhub get-findings --query 'ServiceUpdates'
    info/Service Update/

    AWS Pushes Back Shield Advanced Layer-7 Migration Deadline to January 29, 2027

    AWS updated its Shield Advanced-to-WAF Anti-DDoS migration timeline, first announced July 27: the automatic upgrade of eligible web ACLs, originally set for October 1, now begins October 24, and the retirement of Shield Advanced's legacy application-layer automatic mitigation, originally set for December 31, 2026, is postponed to January 29, 2027.

    Customers still on the legacy feature get roughly one extra month to complete a guided migration to the AWS WAF Anti-DDoS managed rule group before the old feature is switched off.

    Shield AdvancedAWS WAF

    Key Takeaway

    1 item
    $ cat WEEKLY_SUMMARY.md

    The EKS Network Policy Agent bug is a reminder that namespace isolation in Kubernetes is only as strong as the identifiers enforcing it, a plain hyphen was enough to create colliding pod identifiers across namespaces. If your EKS namespaces use hyphens, upgrade the Network Policy Agent to 1.4.0 and don't treat NetworkPolicy alone as your isolation boundary. Separately, if you're still on Shield Advanced's legacy Layer-7 automatic mitigation, the new January 29, 2027 deadline is real relief, but it's still a deadline.

    Filed Under
    EKSNetwork Policy AgentKubernetesShield AdvancedAWS WAFAWS IoT
    Previous
    Week 37 - Sep 7 - Sep 13, 2026

    Need Custom Security Briefings?

    These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.

    All DigestsSubscribe via RSSGet in Touch