What’s Vulnerable › Vulnerabilities

CVE-2026-15738: Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer Controller

• Severity: high (CVSS 8.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-10-24
• Weakness: CWE-653

Description

Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before 3.4.2 might allow an authenticated remote user to intercept, spoof, or deny another namespace's gRPC traffic on a shared Gateway via a crafted HTTPRoute resource. To mitigate this issue, users should upgrade to version 3.4.2.

Affected products

• Amazon aws-load-balancer-controller: before 3.4.2 — fixed in 3.4.2

How to fix

Upgrade to a fixed version: Amazon aws-load-balancer-controller 3.4.2. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/2026-055-aws/
• https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v3.4.2

Get alerted when CVE-2026-15738 or the next vulnerability affects your stack