Skip to content
OpenAdvisories
High · 8.5 CVE-2026-15738 EUVD-2026-44491

Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer Controller

Published Jul 14, 2026 · Updated Jul 15, 2026 · Assigned by AMZN

Description

Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before 3.4.2 might allow an authenticated remote user to intercept, spoof, or deny another namespace's gRPC traffic on a shared Gateway via a crafted HTTPRoute resource.

To mitigate this issue, users should upgrade to version 3.4.2.

Affected products

VendorProductAffectedFixed
Amazon aws-load-balancer-controller < 3.4.2 3.4.2

References