CVE-2026-6437

MediumCVSS 6.5

Published: 17/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.57%

47th percentile - higher than 47% of all known CVEs

Summary

Improper neutralization of argument delimiters in the volume handling component of AWS EFS CSI Driver before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection.

Risk Assessment

A user with PersistentVolume creation permissions can influence mount options, potentially causing unexpected behavior or escalation in the cluster. Authenticated PersistentVolume creation permissions are required.

Recommendation

Upgrade AWS EFS CSI Driver to version v3.0.1 or later. Restrict PersistentVolume creation permissions to trusted users.

Other vulnerabilities in AWS EFS CSI Driver

CVE-2026-103505Medium
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute. To remediate this issue, users should upgrade to version v3.5.0 or later.

Original NVD description (English source)

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users should upgrade to version v3.0.1

Vulnerability data from NVD (NIST) · CISA KEV · EPSS