CVE-2026-6437

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users should upgrade to version v3.0.1

CVSS 4.0

6.9CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS

0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-25)

CWE

CWE-88

Published

2026-04-17

Modified

2026-10-20

Record from

the NVD, synced 2026-10-21

Affected

• amazon:efs_csi_driver

Packages (OSV)

References

• https://aws.amazon.com/security/security-bulletins/2026-016-aws/
• https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.0.1
• https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-mph4-q2vm-w2pw

Check your stackJSON