Vulnerabilidades do AWS Aws-efs-csi-driver
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam AWS Aws-efs-csi-driver: 2 registro(s), com versões afetadas e correções.
CVE-2026-103505
Média · 6.5
CWE-88 01/10/2026
AWS EFS CSI Driver Mount Option Injection via mounttargetipmap
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute.
To remediate this issue, users should upgrade to version v3.5.0 or later.
CVE-2026-85781
Alta · 8.7
CWE-283 04/09/2026
Unverified access point ownership in Amazon EFS CSI Driver
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem.
To remediate this issue, users should upgrade to version v3.4.1.