AWS Load Balancer Controller Priority Bug Lets HTTPRoutes Intercept gRPC Traffic Across Namespaces

The AWS Load Balancer Controller contains a flaw that allows attackers to intercept traffic intended for other services. This issue stems from how the controller assigns priority to application load balancer listener rules.

What happened

AWS Security Bulletins identified CVE-2026-15738 on July 14, 2026. The vulnerability exists in the AWS Load Balancer Controller, an open-source Kubernetes controller managing AWS Elastic Load Balancing resources. The controller generates Gateway API listener rules incorrectly when both HTTPRoute and GRPCRoute objects attach to the same Application Load Balancer HTTPS listener with an identical hostname. Instead of prioritizing routes based on their specificity, the controller assigns priority based on route kind. Consequently, all HTTPRoute-derived rules receive lower ALB priority numbers than GRPCRoute-derived rules.

The Application Load Balancer evaluates lower priority numbers first, causing HTTPRoute rules to take precedence regardless of specificity. A namespace-scoped user with permission to create HTTPRoute objects in a namespace admitted by a shared Gateway can exploit this behavior. By creating a catch-all HTTPRoute, the user can intercept traffic destined for a more-specific GRPCRoute in another namespace. This issue impacts AWS Load Balancer Controller version 3.4.1 and any version that includes support for attaching both HTTPRoute and GRPCRoute to the same listener. That support was introduced in pull request 4794.

Why it matters

This flaw enables cross-namespace traffic interception within Kubernetes clusters using shared Gateways. It undermines network segmentation assumptions by allowing lower-privileged users to disrupt or monitor traffic in other namespaces. The issue affects environments where multiple namespaces attach routes to a single shared Gateway listener. AWS addressed the vulnerability in AWS Load Balancer Controller version 3.4.2. Users are advised to upgrade to the latest version.

Teams using forked or derivative code must patch their implementations to incorporate the new fixes. Restricting the Gateway listener AllowedRoutes.Namespaces.From field to Same limits exposure. Configuring a restrictive namespace Selector also prevents untrusted namespaces from attaching interfering HTTPRoute objects. AWS thanked researcher hakuopi for collaborating through the coordinated vulnerability disclosure process.

What to watch

• Monitor for unexpected HTTPRoute creations in namespaces sharing a Gateway.
• Verify ALB listener rule priorities match expected route specificity.
• Check for traffic interception patterns between namespaces.
• Review Gateway namespace admission policies for overly permissive settings.

Signals worth monitoring

Security teams should examine application load balancer access logs for traffic redirection anomalies. Look for HTTP requests being handled by listeners expecting gRPC payloads. Alert on new route objects created in namespaces that share infrastructure with critical services. Verify that namespace selectors restrict route attachment to trusted sources. Check controller logs for rule generation warnings or priority conflicts. Monitor for increased latency or errors in gRPC services when HTTPRoutes are added. Investigate any cross-namespace traffic flows that bypass intended service mesh policies. Ensure that network policies align with observed traffic patterns.

Background: Network segmentation

Network segmentation divides a large network into smaller, isolated sub-networks. This restricts traffic flow based on strict rules, preventing attackers from moving freely between systems after an initial breach. It reduces the attack surface and contains potential damage by enforcing strict access controls between zones.

Read the full guide: Network Segmentation: Stop Lateral Movement Before It Starts

What to do and how to stay safe: AWS

• Upgrade to AWS Load Balancer Controller version 3.4.2 or later.
• Restrict Gateway listener AllowedRoutes.Namespaces.From to Same.
• Configure restrictive namespace Selectors for shared Gateways.
• Audit existing HTTPRoute and GRPCRoute configurations for conflicts.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of AWS Load Balancer Controller are affected?

Version 3.4.1 and any version with support for attaching both HTTPRoute and GRPCRoute to the same listener.

Is there a fix available for CVE-2026-15738?

Yes, AWS released version 3.4.2 which addresses the incorrect rule precedence ordering issue.

How can users mitigate this issue before upgrading?

Restrict the Gateway listener AllowedRoutes.Namespaces.From field to Same or use restrictive namespace Selectors.