Aws Efs Csi Driver vulnerabilities

2 vulnerabilities

Known vulnerabilities in Aws Efs Csi Driver, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.9CVE-2026-103505awsaws-efs-csi-driver
EPSS score
0.43%
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute. To remediate this issue, users should upgrade to version v3.5.0 or later.8.7CVE-2026-85781awsaws-efs-csi-driver
EPSS score
0.44%
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem. To remediate this issue, users should upgrade to version v3.4.1.