CVE-2026-15738

Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before 3.4.2 might allow an authenticated remote user to intercept, spoof, or deny another namespace's gRPC traffic on a shared Gateway via a crafted HTTPRoute resource. To mitigate this issue, users should upgrade to version 3.4.2.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://aws.amazon.com/security/security-bulletins/2026-055-aws/
https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v3.4.2

Configurations

No configuration.

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Orden de comportamiento incorrecto en la generación de reglas de oyente de la API de Gateway en el controlador de balanceador de carga de Amazon AWS anterior a la versión 3.4.2 podría permitir a un usuario remoto autenticado interceptar, suplantar o denegar el tráfico gRPC de otro espacio de nombres en una Gateway compartida a través de un recurso HTTPRoute manipulado. Para mitigar este problema, los usuarios deberían actualizar a la versión 3.4.2.

Information

Published : 2026-07-14 21:16

Updated : 2026-10-24 21:10

NVD link : CVE-2026-15738

Mitre link : CVE-2026-15738

CVE.ORG link : CVE-2026-15738

JSON object : View

Products Affected

No product.

CWE

CWE-653

Improper Isolation or Compartmentalization

{"id": "CVE-2026-15738", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15738", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-15T13:00:49.984717Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "affectedData": [{"vendor": "Amazon", "product": "aws-load-balancer-controller", "versions": [{"status": "affected", "version": "0", "lessThan": "3.4.2", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-14T21:16:41.440", "references": [{"url": "https://aws.amazon.com/security/security-bulletins/2026-055-aws/", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v3.4.2", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "description": [{"lang": "en", "value": "CWE-653"}]}], "descriptions": [{"lang": "en", "value": "Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before 3.4.2 might allow an authenticated remote user to intercept, spoof, or deny another namespace's gRPC traffic on a shared Gateway via a crafted HTTPRoute resource.\n\n\n\nTo mitigate this issue, users should upgrade to version 3.4.2."}, {"lang": "es", "value": "Orden de comportamiento incorrecto en la generaci\u00f3n de reglas de oyente de la API de Gateway en el controlador de balanceador de carga de Amazon AWS anterior a la versi\u00f3n 3.4.2 podr\u00eda permitir a un usuario remoto autenticado interceptar, suplantar o denegar el tr\u00e1fico gRPC de otro espacio de nombres en una Gateway compartida a trav\u00e9s de un recurso HTTPRoute manipulado.\n\nPara mitigar este problema, los usuarios deber\u00edan actualizar a la versi\u00f3n 3.4.2."}], "lastModified": "2026-10-24T21:10:00.130", "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}