AWS Load Balancer Controller Fix Addresses Cross-Namespace Traffic Interception Flaw
A priority ordering bug in the AWS Load Balancer Controller allowed HTTPRoutes to intercept gRPC traffic. Version 3.4.2 resolves the issue.
Key points
- CVE-2026-15738 affects AWS Load Balancer Controller versions supporting mixed HTTPRoute and GRPCRoute listeners.
- The flaw allows namespace-scoped users to intercept traffic meant for other namespaces via catch-all routes.
- AWS released version 3.4.2 to fix the incorrect rule precedence logic in Gateway API listener generation.
Amazon Web Services published security bulletin 2026-055-AWS on July 14, 2026, addressing a vulnerability in its open-source Load Balancer Controller. The advisory identifies CVE-2026-15738, an issue where incorrect rule precedence ordering allows cross-namespace traffic interception. This flaw impacts Kubernetes clusters using AWS Elastic Load Balancing resources managed by the controller.
The vulnerability stems from how the controller assigns priorities to Application Load Balancer listener rules. When both HTTPRoute and GRPCRoute objects attach to the same HTTPS listener with identical hostnames, the system prioritizes route kind over specificity. Consequently, all HTTPRoute-derived rules receive lower priority numbers than GRPCRoute-derived rules, causing them to be evaluated first by the ALB regardless of actual route matching requirements.
Context and Background
AWS classifies this bulletin as important and requiring attention. The controller manages AWS Elastic Load Balancing resources for Kubernetes clusters, a critical component for many cloud-native deployments. The logic error occurs within the Gateway API listener rule generation process. Specifically, the controller fails to account for route specificity when determining evaluation order for mixed protocol routes on a single listener.
This behavior creates a scenario where a less specific route can intercept traffic intended for a more specific one. The issue was introduced in pull request #4794, which added support for attaching both HTTPRoute and GRPCRoute objects to the same listener. AWS acknowledged the flaw after a coordinated disclosure process.
Who is Affected
The vulnerability impacts AWS Load Balancer Controller version 3.4.1 and any subsequent version that includes the mixed-route listener support. Any environment where a shared Gateway admits multiple namespaces is at risk. A namespace-scoped user with permission to create HTTPRoute objects can exploit this weakness if they have access to a namespace admitted by a shared Gateway.
According to the advisory, an attacker can create a catch-all HTTPRoute in their namespace. This route will intercept traffic intended for a more-specific GRPCRoute located in a different namespace. This allows unauthorized interception of gRPC traffic via HTTP routes, bypassing intended routing isolation between namespaces.
AWS thanked researcher hakuopi for collaborating on the issue through the coordinated vulnerability disclosure process. The company recommends that users ensure any forked or derivative code is patched to incorporate these new fixes alongside the official update.
What should you do?
AWS has addressed the issue in AWS Load Balancer Controller version 3.4.2. Users are advised to upgrade to the latest version immediately. For those who cannot upgrade immediately, AWS recommends restricting the Gateway listener AllowedRoutes.Namespaces.From field to Same. Alternatively, configuring a restrictive namespace Selector can limit which namespaces may attach routes to a shared Gateway.
These mitigations prevent untrusted namespaces from attaching HTTPRoute objects that could interfere with GRPCRoute rules in other namespaces. Organizations should verify their current controller version and check if mixed HTTPRoute and GRPCRoute configurations exist on shared listeners.
Background: Coordinated vulnerability disclosure
Coordinated vulnerability disclosure reveals software flaws to vendors before public release. Small teams must patch during this quiet period. Monitor vendor security pages, prioritize critical updates, and verify that your IT provider tracks these disclosures to prevent exploitation of known weaknesses before public patches arrive.
Read the full guide: Coordinated Vulnerability Disclosure for Small Teams
What to do and how to stay safe: AWS
- Update AWS Load Balancer Controller to version 3.4.2 or later to resolve the priority ordering flaw.
- Review Gateway configurations to ensure AllowedRoutes.Namespaces.From is set to Same where possible.
- Implement restrictive namespace Selectors to limit which namespaces can attach routes to shared Gateways.
- Audit existing HTTPRoute and GRPCRoute objects on shared listeners for potential catch-all interceptors.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which AWS Load Balancer Controller versions are vulnerable to CVE-2026-15738?
Version 3.4.1 and any version that includes support for attaching both HTTPRoute and GRPCRoute to the same listener are affected.
What is the severity of this vulnerability?
AWS classifies the bulletin as Important, requiring attention, but does not provide a CVSS score in the advisory.
Can this vulnerability be exploited remotely?
A namespace-scoped user with permission to create HTTPRoute objects in a namespace admitted by a shared Gateway can exploit this flaw.
