CVE Intelligence

AWS Aws-efs-csi-driver vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting AWS Aws-efs-csi-driver: 2 record(s), with affected versions and fixes.

CVE-2026-103505 Medium · 6.5 CWE-88 Oct 1, 2026
AWS EFS CSI Driver Mount Option Injection via mounttargetipmap
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute. To remediate this issue, users should upgrade to version v3.5.0 or later.
CVE-2026-85781 High · 8.7 CWE-283 Sep 4, 2026
Unverified access point ownership in Amazon EFS CSI Driver
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem. To remediate this issue, users should upgrade to version v3.4.1.