Is there a patch available for CVE-2026-15738?

Yes, a patch is available for CVE-2026-15738. Update the affected software to the latest version immediately.

AWS Load Balancer Controller CVE-2026-15738

Q: What is the CVSS score of CVE-2026-15738?

CVE-2026-15738 has a CVSS 4.0 base score of 5.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-44491 MEDIUM

Improper Isolation or Compartmentalization (CWE-653)

2026-07-14 AMZN

Information Disclosure Amazon Aws Load Balancer Controller

5.8

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

5.8 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

AC:H for required multi-tenant Gateway configuration prerequisite; PR:L for authenticated namespace-scoped Kubernetes user; S:C with C/I/A:H reflecting full cross-namespace traffic compromise.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 12:37 vuln.today

Analysis Generated

Jul 22, 2026 - 12:37 vuln.today

Patch available

Jul 14, 2026 - 23:20 EUVD

DescriptionCVE.org

Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before 3.4.2 might allow an authenticated remote user to intercept, spoof, or deny another namespace's gRPC traffic on a shared Gateway via a crafted HTTPRoute resource.

To mitigate this issue, users should upgrade to version 3.4.2.

AnalysisAI

Incorrect listener-rule priority ordering in AWS Load Balancer Controller before v3.4.2 enables authenticated Kubernetes users to intercept, spoof, or deny gRPC traffic belonging to other namespaces on a shared Gateway. The controller incorrectly assigned ALB listener rule priority by route kind (HTTPRoute vs GRPCRoute) rather than route specificity, causing all HTTPRoutes to be evaluated before GRPCRoutes at the ALB layer regardless of which was more specific or narrower in scope. No public exploit has been identified at time of analysis, but the SSVC framework rates technical impact as total for the subsequent system, reflecting that cross-namespace traffic confidentiality, integrity, and availability are fully compromised when conditions are met.

Technical ContextAI

AWS Load Balancer Controller is a Kubernetes controller that provisions AWS Application Load Balancers using the Kubernetes Gateway API (HTTPRoute, GRPCRoute). When multiple route types attach to the same HTTPS listener on a shared Gateway, the controller generates ALB listener rules and assigns priority numbers to determine evaluation order. The root cause, addressed in PR #4818, is that priority was assigned by route kind rather than route specificity: HTTPRoutes always received lower ALB priority numbers (evaluated first) than GRPCRoutes, regardless of path, hostname, or header specificity. CWE-653 (Insufficient Compartmentalization) accurately describes the flaw - the controller failed to enforce namespace isolation when generating cross-kind routing rules, allowing one tenant's route to shadow another's. The fix implements a unified precedence comparator ordering rules by hostname specificity, path type, path length, method constraint, header count, and creation timestamp, independent of route kind. Affected CPE: cpe:2.3:a:amazon:aws-load-balancer-controller:*:*:*:*:*:*:*:* with all versions prior to 3.4.2.

RemediationAI

Upgrade to AWS Load Balancer Controller v3.4.2, released at https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v3.4.2 and documented in AWS security bulletin https://aws.amazon.com/security/security-bulletins/2026-055-aws/. The v3.4.2 release requires no CRD updates, no IAM policy changes, and no Gateway API CRD updates, reducing upgrade friction. For clusters that cannot immediately upgrade, the confirmed workaround is to restrict each Gateway listener's AllowedRoutes.Namespaces.From to Same instead of All, or to apply a restrictive namespace Selector that limits route attachment to a single trusted namespace - this eliminates the cross-namespace attack surface entirely. The trade-off of this workaround is loss of cross-namespace routing flexibility on shared Gateways, which may require architectural adjustments in environments that rely on multi-tenant Gateway sharing.