CVE-2026-15738: AWS Load Balancer Auth Bypass Vulnerability

CVE-2026-15738 Overview

CVE-2026-15738 affects the Amazon AWS Load Balancer Controller before version 3.4.2. The vulnerability stems from an incorrect behavior order [CWE-653] in the Gateway API listener-rule generation logic. An authenticated remote user can craft a malicious HTTPRoute resource to intercept, spoof, or deny gRPC traffic belonging to another namespace on a shared Gateway. The flaw enables cross-tenant traffic manipulation in shared multi-tenant Kubernetes clusters that rely on the AWS Load Balancer Controller for Gateway API implementation. AWS resolved the issue in version 3.4.2 and published details in AWS Security Bulletin 2026-055.

Critical Impact
Authenticated users with HTTPRoute creation privileges in one namespace can intercept, spoof, or deny gRPC traffic destined for workloads in other namespaces sharing the same Gateway.

Affected Products

Amazon AWS Load Balancer Controller versions prior to 3.4.2
Kubernetes clusters using the Gateway API implementation from AWS Load Balancer Controller
Multi-tenant environments with shared Gateway resources across namespaces

Discovery Timeline

2026-07-14 - CVE-2026-15738 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15738

Vulnerability Analysis

The AWS Load Balancer Controller translates Kubernetes Gateway API resources into Application Load Balancer (ALB) listener rules. When multiple namespaces share a Gateway, the controller must correctly order listener rules to enforce namespace isolation. The vulnerability arises from an incorrect ordering of these rules during generation for gRPC traffic routing.

A crafted HTTPRoute resource from a lower-privileged namespace can produce listener rules evaluated before rules for legitimate routes in other namespaces. The result is that gRPC requests intended for another tenant's service can be matched by the attacker's route first. This gives the attacker the ability to redirect, mirror, or drop traffic that should never touch their namespace.

The weakness is classified under [CWE-653]: Improper Isolation or Compartmentalization. It requires an authenticated user with permission to create HTTPRoute resources but no elevated cluster privileges.

Root Cause

The root cause is the ordering algorithm that generates ALB listener rules from Gateway API HTTPRoute objects. The controller failed to apply namespace-scoped precedence correctly when routes targeted gRPC backends on a shared listener. Rules from unrelated namespaces could take priority over the intended tenant's rules.

Attack Vector

An authenticated user submits an HTTPRoute resource with match criteria that overlap with another namespace's gRPC service on the same shared Gateway. Because the generated listener rule receives higher evaluation priority, the ALB routes matching gRPC calls to the attacker-controlled backend. The attacker can then intercept payloads, respond with spoofed messages, or drop traffic to cause a denial of service. Refer to the AWS Security Bulletin 2026-055 for AWS's technical description.

No public proof-of-concept exploit is available. The EPSS probability is 0.373% as of 2026-07-20.

Detection Methods for CVE-2026-15738

Indicators of Compromise

Unexpected HTTPRoute resources referencing gRPC backends outside their creating namespace
ALB listener rules with priority values that place lower-privileged namespace routes ahead of production routes
Anomalous gRPC error rates, latency spikes, or authentication failures on services fronted by a shared Gateway
Traffic logs showing gRPC requests terminating at unexpected target groups

Detection Strategies

Audit Kubernetes API server logs for HTTPRoute create and update events, correlating the requesting service account with the target Gateway namespace
Compare generated ALB listener rule ordering against the intended namespace routing policy using AWS CLI or the ELBv2 API
Enable AWS CloudTrail logging on ElasticLoadBalancingV2 API calls to track rule modifications performed by the controller

Monitoring Recommendations

Alert on any HTTPRoute creation by service accounts that historically did not create Gateway API resources
Monitor ALB access logs for sudden shifts in gRPC target group distribution across services
Track version metadata for the AWS Load Balancer Controller deployment and alert if it falls below 3.4.2

How to Mitigate CVE-2026-15738

Immediate Actions Required

Upgrade the AWS Load Balancer Controller to version 3.4.2 or later across all clusters
Inventory shared Gateway resources and identify which namespaces have HTTPRoute creation permissions
Review existing HTTPRoute objects for suspicious cross-namespace gRPC backend references

Patch Information

AWS released version 3.4.2 of the AWS Load Balancer Controller to correct the listener-rule generation order. Upgrade instructions and release notes are available in the GitHub Release v3.4.2. Full advisory context is published in the AWS Security Bulletin 2026-055.

Workarounds

Restrict HTTPRoute creation permissions using Kubernetes RBAC so only trusted service accounts can define routes on shared Gateways
Avoid sharing a single Gateway across untrusted tenants until the controller is upgraded; deploy separate Gateways per tenant namespace
Apply admission control policies (for example, Kyverno or OPA Gatekeeper) to reject HTTPRoute resources that reference backends outside the creating namespace

bash

# Verify installed AWS Load Balancer Controller version
kubectl get deployment -n kube-system aws-load-balancer-controller \
  -o jsonpath='{.spec.template.spec.containers[0].image}'

# Upgrade via Helm to the patched release
helm repo update eks
helm upgrade aws-load-balancer-controller eks/aws-load-balancer-controller \
  -n kube-system --version 3.4.2