The AWS Load Balancer Controller generates Gateway API listener rules in incorrect order when processing HTTPRoute resources. As a result, an authenticated user who can craft a malicious HTTPRoute can cause the controller to route gRPC traffic intended for one namespace to another namespace. This allows interception of data, manipulation of traffic, or denial of service for that namespace's services. The weakness corresponds to improper handling of routing precedence, identified as CWE‑653.

Amazon’s AWS Load Balancer Controller versions prior to 3.4.2 are susceptible. Any deployment using 3.4.1 or earlier with shared Gateways and multiple namespaces is at risk. The vulnerability does not affect the platform itself, only the configuration of HTTPRoute objects in those older releases.

The CVSS score of 5.8 indicates moderate severity. The EPSS score is reported as < 1 %, implying a very low probability of exploitation under typical conditions. The vulnerability is not in the CISA KEV catalog. The likely attack vector is an authenticated remote user who has permission to create or modify HTTPRoute resources; such a user could craft a route that redirects traffic from another namespace. While the scope is limited to the Kubernetes cluster’s Gateway configuration, the impact on confidentiality, integrity, and availability for the affected namespace can be significant if exploited. Prompt remediation is recommended to eliminate this risk.