diff --git a/.changelog/16776.txt b/.changelog/16776.txt
new file mode 100644
index 000000000000..00971d3a19fc
--- /dev/null
+++ b/.changelog/16776.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fix CNI plugin version fingerprint when output includes protocol version
+```
diff --git a/client/fingerprint/plugins_cni.go b/client/fingerprint/plugins_cni.go
index e1eb89d3e8f0..b6fe9af27890 100644
--- a/client/fingerprint/plugins_cni.go
+++ b/client/fingerprint/plugins_cni.go
@@ -101,9 +101,9 @@ func (f *PluginsCNIFingerprint) detectOne(cniPath string, entry os.DirEntry) (st
 	// e.g.
 	//  /opt/cni/bin/bridge <no args>
 	//  CNI bridge plugin v1.0.0
+	//  (and optionally another line that contains the supported CNI protocol versions)
 	tokens := strings.Fields(string(output))
-	for i := len(tokens) - 1; i >= 0; i-- {
-		token := tokens[i]
+	for _, token := range tokens {
 		if _, parseErr := version.NewSemver(token); parseErr == nil {
 			return token, true
 		}
diff --git a/client/fingerprint/plugins_cni_test.go b/client/fingerprint/plugins_cni_test.go
index 4a03baec0a00..c8342d97023c 100644
--- a/client/fingerprint/plugins_cni_test.go
+++ b/client/fingerprint/plugins_cni_test.go
@@ -26,8 +26,10 @@ func TestPluginsCNIFingerprint_Fingerprint_present(t *testing.T) {
 	must.True(t, response.Detected)
 	attrCustom := f.(*PluginsCNIFingerprint).attribute("custom")
 	attrBridge := f.(*PluginsCNIFingerprint).attribute("bridge")
+	attrVlan := f.(*PluginsCNIFingerprint).attribute("vlan")
 	must.Eq(t, "v1.2.3", response.Attributes[attrCustom])
 	must.Eq(t, "v1.0.2", response.Attributes[attrBridge])
+	must.Eq(t, "v1.2.0", response.Attributes[attrVlan])
 }
 
 func TestPluginsCNIFingerprint_Fingerprint_absent(t *testing.T) {
diff --git a/client/fingerprint/test_fixtures/cni/bridge b/client/fingerprint/test_fixtures/cni/bridge
index 0b7f14f7f506..d62b0caa694f 100755
--- a/client/fingerprint/test_fixtures/cni/bridge
+++ b/client/fingerprint/test_fixtures/cni/bridge
@@ -1,3 +1,4 @@
 #!/bin/sh
 
+# This fixture uses the old version output, without the supported CNI protocol versions.
 echo "CNI bridge plugin v1.0.2"
diff --git a/client/fingerprint/test_fixtures/cni/vlan b/client/fingerprint/test_fixtures/cni/vlan
new file mode 100755
index 000000000000..e10b36b1d750
--- /dev/null
+++ b/client/fingerprint/test_fixtures/cni/vlan
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+# This fixture uses the new version output, including the supported CNI protocol versions.
+echo "CNI vlan plugin v1.2.0"
+echo "CNI protocol versions supported: 0.1.0, 0.2.0, 0.3.0, 0.3.1, 0.4.0, 1.0.0"