CVE-2026-15738: AWS Load Balancer Controller Route Priority Bypass via HTTPRoute

Vulnerability Overview Vulnerability ID: CVE-2026-15738 Description: The AWS Load Balancer Controller is an open-source Kubernetes controller used to manage AWS Elastic Load Balancing resources within Kubernetes clusters. An incorrect rule priority sorting issue was discovered in the Gateway API listener rule generation logic. When HTTPRoute and GRPCRoute resources are attached to the same Application Load Balancer (ALB) HTTPS listener and share the same hostname, the controller assigns ALB listener rule priorities based on route type rather than route specificity. This results in all HTTPRoute-based rules receiving lower ALB priority numbers, even if they are more specific than GRPCRoute-based rules. A namespace-scoped user with permission to create HTTPRoute objects in another namespace could create an all-catch HTTPRoute, intercepting traffic that should have been handled by more specific GRPCRoute rules. Impact Scope Affected Versions: AWS Load Balancer Controller v3.4.1 and any subsequent versions supporting the attachment of HTTPRoute and GRPCRoute to the same listener (introduced in PR #84794). Remediation Fix: This issue has been resolved in AWS Load Balancer Controller version 3.4.2. It is recommended to upgrade to the latest version and ensure that any forks or derived codebases are patched to include this fix. Workaround: Restrict the field of the Gateway listener to , or configure a restrictive namespace selector that limits which namespaces can attach routes to the shared Gateway. This prevents untrusted namespaces from attaching HTTPRoute objects that could interfere with GRPCRoute rules. References CVE-2026-15738 5456-cvmh-7b8w-9213 Acknowledgments Thanks to hakuopi for collaborating on this issue through the coordinated vulnerability disclosure program. Contact For any security concerns or questions, please email aws-security@amazon.com.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-15738: AWS Load Balancer Controller Route Priority Bypass via HTTPRoute