In this configuration, if the WAF becomes unavailable (e.g., due to a service disruption or misconfiguration), incoming traffic bypasses the WAF entirely. This can result in the application receiving unfiltered traffic, which could expose it to malicious requests or vulnerabilities.
An attacker takes advantage of a WAF service disruption, knowing that if the WAF fails, traffic is allowed to pass through without filtering. The attacker sends malicious requests, such as SQL injection payloads, to the ALB. With WAF set to "fail open," the malicious requests bypass the protection layer, potentially compromising the application.
