CVE-2026-15738 Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer Controller

Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before 3.4.2 might allow an authenticated remote user to intercept, spoof, or deny another namespace's gRPC traffic on a shared Gateway via a crafted HTTPRoute resource. To mitigate this...

CVE-2026-15738

The CVE-2026-15738 issue affects the AWS Load Balancer Controller prior to version 3.4.2, where incorrect behavior order in Gateway API listener-rule generation can let an authenticated remote user intercept, spoof, or deny another namespace’s gRPC traffic on a shared Gateway via a crafted HTTPRo...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, incert, nerdctl, aws-flb-kinesis-fips, promxy-fips, cert-manager-fips, secrets-store-csi-driver-provider-azure, certificate-transparency-fips, harbor-scanner-trivy-fips, opentelemetry-collector-contrib,...

GHSA-62JJ-GR2R-5C34 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, incert, nerdctl, aws-flb-kinesis-fips, mockgen, mongodb-kubernetes-operator-fips, promxy-fips, yunikorn-k8shim-fips, kor, cert-manager-fips, spqr, secrets-store-csi-driver-provider-azure, litestream, harbor-scanner-trivy-fips,...

GHSA-W32M-9786-JP63 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-rds, fuse-overlayfs-snapshotter, flux, eksctl, litefs, terraform-provider-pagerduty, smarter-device-manager, lazygit, opensearch-k8s-operator, k8sgpt-operator, ip-masq-agent, crossplane-provider-azure-sql, mailpit, zot,...

GO-2024-3212 AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers in sigs.k8s.io/aws-load-balancer-controller

AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers in sigs.k8s.io/aws-load-balancer-controller. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...

AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers

Summary The AWS Load Balancer Controller includes an optional, default-enabled feature that manages WAF WebACLs on Application Load Balancers ALBs on your behalf. In versions 2.8.1 and earlier, if the WebACL annotation 1 alb.ingress.kubernetes.io/wafv2-acl-arn or...

GHSA-RJFV-PJVX-MJGV AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers

Summary The AWS Load Balancer Controller includes an optional, default-enabled feature that manages WAF WebACLs on Application Load Balancers ALBs on your behalf. In versions 2.8.1 and earlier, if the WebACL annotation 1 alb.ingress.kubernetes.io/wafv2-acl-arn or...

Important: Red Hat Enhancement Advisory: Release of AWS Load Balancer Operator 1.1.z on OperatorHub

Release of AWS Load Balancer Operator 1.1.z Release of OpenShift AWS Load Balancer Operator 1.1.z...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, pulumi-language-java, newrelic-infrastructure-agent, flux-image-reflector-controller, node-problem-detector, pulumi, kind, cue, src, kubernetes-ingress-defaultbackend, aws-ebs-csi-driver, kubeflow,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, pulumi-language-java, newrelic-infrastructure-agent, flux-image-reflector-controller, node-problem-detector, pulumi, kind, cue, src, kubernetes-ingress-defaultbackend, aws-ebs-csi-driver, kubeflow,...

GHSA-R25M-CR6V-P9HQ ethyca-fides Webserver API Path Traversal vulnerability

Impact A path traversal directory traversal vulnerability affects fides versions lower than 2.15.1, allowing remote attackers to access arbitrary files on the fides webserver container's filesystem. Patches The vulnerability is patched in fides 2.15.1. Users should upgrade to this version...

Path traversal

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. A path traversal directory traversal vulnerability affects fides versions lower than version 2.15.1, allowing...

Kubernetes: AWS Load Balancer Controller can be used by an attacker to modify rules of any Security Group that they are able to tag

Report Submission Form Summary: The IAM Policy of AWS Load Balancer Controller allows it to modify rules of any SG on the AWS Account. This is legitimately used to manage Security Groups created by the controller when an Ingress resource doesn’t explicit a SG. Annotations can be added to the...

Kubernetes: AWS Load Balancer Controller Managed Security Groups can be replaced by an unprivileged attacker

Report Submission Form Summary: When creating an Ingress of class alb, by default, AWS Load Balancer Controller creates a managed SG and attaches it to the created ALB. This SG limits which ports of the ALB are accessible by whom. An attacker is able to craft another SG that can be used to trick...