Aws Load Balancer Controller
Monthly
Incorrect listener-rule priority ordering in AWS Load Balancer Controller before v3.4.2 enables authenticated Kubernetes users to intercept, spoof, or deny gRPC traffic belonging to other namespaces on a shared Gateway. The controller incorrectly assigned ALB listener rule priority by route kind (HTTPRoute vs GRPCRoute) rather than route specificity, causing all HTTPRoutes to be evaluated before GRPCRoutes at the ALB layer regardless of which was more specific or narrower in scope. No public exploit has been identified at time of analysis, but the SSVC framework rates technical impact as total for the subsequent system, reflecting that cross-namespace traffic confidentiality, integrity, and availability are fully compromised when conditions are met.
Incorrect listener-rule priority ordering in AWS Load Balancer Controller before v3.4.2 enables authenticated Kubernetes users to intercept, spoof, or deny gRPC traffic belonging to other namespaces on a shared Gateway. The controller incorrectly assigned ALB listener rule priority by route kind (HTTPRoute vs GRPCRoute) rather than route specificity, causing all HTTPRoutes to be evaluated before GRPCRoutes at the ALB layer regardless of which was more specific or narrower in scope. No public exploit has been identified at time of analysis, but the SSVC framework rates technical impact as total for the subsequent system, reflecting that cross-namespace traffic confidentiality, integrity, and availability are fully compromised when conditions are met.