diff --git a/cmd/neofs-node/cache.go b/cmd/neofs-node/cache.go
index a888ed952..b50ba6277 100644
--- a/cmd/neofs-node/cache.go
+++ b/cmd/neofs-node/cache.go
@@ -5,8 +5,10 @@ import (
 	"time"
 
 	lru "github.com/hashicorp/golang-lru"
+	eaclSDK "github.com/nspcc-dev/neofs-api-go/pkg/acl/eacl"
 	containerSDK "github.com/nspcc-dev/neofs-api-go/pkg/container"
 	"github.com/nspcc-dev/neofs-node/pkg/core/container"
+	"github.com/nspcc-dev/neofs-node/pkg/services/object/acl/eacl"
 )
 
 type netValueReader func(interface{}) (interface{}, error)
@@ -108,3 +110,34 @@ func (s *ttlContainerStorage) Get(cid *containerSDK.ID) (*containerSDK.Container
 
 	return val.(*containerSDK.Container), nil
 }
+
+type ttlEACLStorage ttlNetCache
+
+func newCachedEACLStorage(v eacl.Storage) eacl.Storage {
+	const (
+		eaclCacheSize = 100
+		eaclCacheTTL  = 30 * time.Second
+	)
+
+	lruCnrCache := newNetworkTTLCache(eaclCacheSize, eaclCacheTTL, func(key interface{}) (interface{}, error) {
+		cid := containerSDK.NewID()
+
+		err := cid.Parse(key.(string))
+		if err != nil {
+			return nil, err
+		}
+
+		return v.GetEACL(cid)
+	})
+
+	return (*ttlEACLStorage)(lruCnrCache)
+}
+
+func (s *ttlEACLStorage) GetEACL(cid *containerSDK.ID) (*eaclSDK.Table, error) {
+	val, err := (*ttlNetCache)(s).get(cid.String())
+	if err != nil {
+		return nil, err
+	}
+
+	return val.(*eaclSDK.Table), nil
+}
diff --git a/cmd/neofs-node/object.go b/cmd/neofs-node/object.go
index 78a4b481f..5a4372e70 100644
--- a/cmd/neofs-node/object.go
+++ b/cmd/neofs-node/object.go
@@ -343,9 +343,9 @@ func initObjectService(c *cfg) {
 				),
 				acl.WithLocalStorage(ls),
 				acl.WithEACLValidatorOptions(
-					eacl.WithEACLStorage(&morphEACLStorage{
+					eacl.WithEACLStorage(newCachedEACLStorage(&morphEACLStorage{
 						w: c.cfgObject.cnrClient,
-					}),
+					})),
 					eacl.WithLogger(c.log),
 				),
 				acl.WithNetmapState(c.cfgNetmap.state),