Key points
- AWS released version 3.4.2 to fix incorrect rule precedence in the Load Balancer Controller.
- The flaw allowed cross-namespace traffic interception when HTTP and gRPC routes shared a listener.
- Users can mitigate risk by restricting Gateway namespace access to trusted sources only.
AWS has released version 3.4.2 of the Load Balancer Controller to address CVE-2026-15738. This update fixes an issue where traffic intended for specific services could be intercepted by other users. The vulnerability affects clusters using Kubernetes Gateway API resources. Teams running version 3.4.1 or earlier forks that support mixed route types should upgrade immediately. The fix ensures that route specificity determines priority, preventing unauthorized traffic capture.
In plain English
The controller manages how traffic flows into Kubernetes clusters through AWS load balancers. When both HTTP and gRPC routes connect to the same listener with the same hostname, the old logic assigned priorities incorrectly. It prioritized route type over specificity, meaning a broad HTTP route could override a precise gRPC route. This allowed a user in one namespace to create a catch-all rule. That rule would intercept traffic meant for a different, more specific service in another namespace.
The background
AWS identified this incorrect rule precedence ordering in the Gateway API listener generation logic. The issue arises when HTTPRoute and GRPCRoute objects attach to the same Application Load Balancer HTTPS listener. The controller previously assigned lower priority numbers to HTTPRoute-derived rules. This caused the load balancer to evaluate those rules first, regardless of specificity. A namespace-scoped user with permission to create HTTPRoute objects could exploit this behavior. They could intercept traffic intended for a more-specific GRPCRoute in a separate namespace.
What changes now
Version 3.4.2 corrects the priority assignment logic. The controller now evaluates route specificity rather than just the route kind. AWS recommends upgrading to this latest version. Users with forked or derivative code must patch their builds to incorporate these fixes. Additionally, administrators can restrict the Gateway listener AllowedRoutes.Namespaces.From field. Setting this to Same or using a restrictive selector limits which namespaces may attach routes. This prevents untrusted namespaces from interfering with other services.
Who needs to act first
Security operations teams should prioritize updating systems that expose shared gateways to multiple namespaces. Check environments where different teams manage separate namespaces but share a single ingress point. Roll out the version 3.4.2 update to these exposed clusters first. If immediate updating is not possible, restrict namespace permissions on the Gateway configuration. Verify that only trusted namespaces can attach routes to shared listeners. Test the configuration changes in a staging environment before applying them to production systems.
What to do and how to stay safe: AWS
- Upgrade AWS Load Balancer Controller to version 3.4.2 or later on all affected clusters.
- Restrict Gateway listener namespace access to prevent untrusted users from attaching routes.
- Audit existing HTTPRoute and GRPCRoute configurations for overlapping hostnames on shared listeners.
- Monitor load balancer logs for unexpected traffic patterns during the transition period.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the AWS Load Balancer Controller are affected by CVE-2026-15738?
Version 3.4.1 and any version that includes support for attaching both HTTPRoute and GRPCRoute to the same listener are impacted.
Is there a patch available for this vulnerability?
Yes, the issue has been addressed in AWS Load Balancer Controller version 3.4.2.
How can users mitigate this issue if they cannot upgrade immediately?
Users can restrict the Gateway listener AllowedRoutes.Namespaces.From field to Same or configure a restrictive namespace selector.
