Executive brief
The AWS Load Balancer Controller, which manages network traffic for Kubernetes clusters, contains a flaw in how it prioritizes traffic rules. An authorized user in one part of a shared system could create a malicious rule to intercept, block, or spoof sensitive gRPC traffic belonging to a different department or application. This could lead to unauthorized data access or service disruptions in multi-tenant environments.
Technical details
A vulnerability in the Gateway API listener-rule generation logic of the AWS Load Balancer Controller exists when both HTTPRoute and GRPCRoute are attached to the same Application Load Balancer (ALB) listener. The controller incorrectly assigned rule priorities based on the route 'kind' rather than specificity, giving HTTPRoute-derived rules higher priority (lower ALB priority numbers) than GRPCRoute-derived rules. An attacker with permissions to create HTTPRoute objects in an admitted namespace can deploy a catch-all route to intercept traffic intended for a more specific GRPCRoute in a different namespace. This issue is resolved in version 3.4.2 by implementing a unified precedence comparator that prioritizes hostname specificity and path length over route kind.
Affected products
- Amazon AWS Load Balancer Controller < 3.4.2
Timeline
- 2026-07-13: patched: Version 3.4.2 released
- 2026-07-14: disclosed: Security bulletin published by AWS