CVE-2026-15738Patch

LOWCVSS 5.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before 3.4.2 might allow an authenticated remote user to intercept, spoof, or deny another namespace's gRPC traffic on a shared Gateway via a crafted HTTPRoute resource. To mitigate this issue, users should upgrade to version 3.4.2.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-653

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Full discourse1 post

Xavier Rivera@XavierRiveraX91d
Patch
AWS patched CVE-2026-15738 in its Kubernetes Load Balancer Controller. When an HTTPRoute and GRPCRoute shared an ALB listener and hostname, rules got ordered by route type, not specificity, so a broad HTTPRoute always ran first, even against a narrower GRPCRoute in another namespace. A namespace-scoped user with HTTPRoute permissions on a shared Gateway could intercept another team's traffic.
Post summary
AWS has released a patch for CVE‑2026‑15738 in its Kubernetes Load Balancer Controller, which prevented namespace‑scoped users from intercepting traffic due to misordered ALB listener rules.
00021751
601 followersView on X

Explore more

Back to dashboard