CVE-2026-6437

AWS EFS CSI Driver Mount Option Injection

6.9 MediumFix available

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection.

To remediate this issue, users should upgrade to version v3.0.1

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.56%Up 0.5 points since Apr 18, 2026

What each source reports

CVE List Score used 6.9

AWS EFS CSI Driver Mount Option Injection

To remediate this issue, users should upgrade to version v3.0.1

Record: CVE-2026-6437
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-88
Updated: 2026-11-02

EUVDEUVD-2026-23500 6.9

To remediate this issue, users should upgrade to version v3.0.1

Record: EUVD-2026-23500
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mph4-q2vm-w2pw 6.9

Amazon EFS CSI Driver has mount option injection via unsanitized volumeHandle and mounttargetip fields

Summary

The Amazon EFS CSI Driver is a Container Storage Interface driver that allows Kubernetes clusters to use Amazon Elastic File System. An issue exists where, under certain circumstances, unsanitized values in the volumeHandle and mounttargetip fields are passed directly to the mount command, allowing injection of arbitrary mount options.

Impact

An actor with PersistentVolume creation privileges can inject arbitrary mount options by appending comma-separated values to the Access Point ID in volumeHandle or to the mounttargetip volumeAttribute. The mount utility parses comma-separated values as separate options, causing the injected options to be applied to the filesystem mount without authorization.

Impacted versions: <= v3.0.0

Patches

This issue has been addressed in Amazon EFS CSI Driver version v3.0.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

Restrict PersistentVolume and StorageClass creation to cluster administrators using Kubernetes RBAC, preventing untrusted users from supplying arbitrary field values.

References

If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.

Acknowledgement

We would like to thank Shaul Ben-Hai from Sentinel One for collaborating on this issue through the coordinated vulnerability disclosure process.

Record: GHSA-mph4-q2vm-w2pw
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-88
Updated: 2026-11-02

NVD 6.9

To remediate this issue, users should upgrade to version v3.0.1

Record: CVE-2026-6437
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-88
Updated: 2026-11-02

OSV 6.9

AWS EFS CSI Driver Mount Option Injection

To remediate this issue, users should upgrade to version v3.0.1

Record: CVE-2026-6437
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N
Weakness: CWE-88
Updated: 2026-11-02

OSVGHSA-mph4-q2vm-w2pw 6.9

Amazon EFS CSI Driver has mount option injection via unsanitized volumeHandle and mounttargetip fields

Summary

Impact

Impacted versions: <= v3.0.0

Patches

This issue has been addressed in Amazon EFS CSI Driver version v3.0.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

Restrict PersistentVolume and StorageClass creation to cluster administrators using Kubernetes RBAC, preventing untrusted users from supplying arbitrary field values.

References

Acknowledgement

We would like to thank Shaul Ben-Hai from Sentinel One for collaborating on this issue through the coordinated vulnerability disclosure process.

Record: GHSA-mph4-q2vm-w2pw
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-88
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/kubernetes-sigs/aws-efs-csi-driver` Go	before 1.7.8-0.20260416142831-51806c22c575	1.7.8-0.20260416142831-51806c22c575

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-6437 is a medium vulnerability (CVSS 6.9) in Amazon Aws Efs Csi Driver, published April 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 47th percentile. Fixed in github.com/kubernetes-sigs/aws-efs-csi-driver 1.7.8-0.20260416142831-51806c22c575.