AWS Load Balancer Controller Flaw Lets Developers Expose Any Security Group to Internet

A security vulnerability in the AWS Load Balancer Controller for EKS allows a developer with standard Kubernetes namespace access and ec2:CreateTags permission to hijack any AWS security group. The controller identifies security groups it manages solely through EC2 tags, meaning an attacker can apply matching tags to a victim security group — such as one protecting a database — and trick the controller into treating it as its own. Once the attacker creates a corresponding Ingress resource, the controller reconciles and applies the Ingress annotations, potentially opening the security group to unrestricted internet access on any port. The attack, documented in HackerOne report #1238482, bypasses standard controls like RBAC and IAM policy review because the controller acts on tag state alone, without verifying true ownership. Organizations can detect the resulting misconfiguration through continuous infrastructure compliance checks that flag security groups with unrestricted inbound rules, even if the root cause is not immediately apparent.