The AWS Load Balancer Controller has a rule precedence ordering flaw (CVE-2026-15738) in its Gateway API listener rule generation logic. When HTTPRoute and GRPCRoute objects are attached to the same ALB HTTPS listener with the same hostname, the controller assigns rule priorities based on route kind rather than specificity. Consequently, HTTPRoute-derived rules get evaluated before GRPCRoute-derived rules regardless of specificity, enabling a namespace-scoped user with permission to create HTTPRoute objects to intercept traffic intended for more specific GRPCRoutes in other namespaces. This affects AWS Load Balancer Controller v3.4.1 and versions supporting both route types on the same listener (introduced in PR #4794). The issue is resolved in version 3.4.2.

A namespace-scoped user with permission to create HTTPRoute objects in a namespace admitted by a shared Gateway can create a catch-all HTTPRoute that intercepts traffic intended for more-specific GRPCRoutes in other namespaces. This cross-namespace traffic interception could lead to unauthorized access or traffic manipulation between Kubernetes namespaces sharing the same ALB HTTPS listener.

An official fix is available in AWS Load Balancer Controller version 3.4.2. Users should upgrade to this version or later to remediate the issue. Additionally, as a workaround, restrict the Gateway listener AllowedRoutes.Namespaces.From field to 'Same' or configure a restrictive namespace Selector to limit which namespaces may attach routes to the shared Gateway. This prevents untrusted namespaces from creating HTTPRoute objects that interfere with GRPCRoute rules in other namespaces.