CVE-2026-6437

AWS EFS CSI Driver Mount Option Injection

State: Published
Severity: 6.9 Medium
Published: Apr 17, 2026
Updated: Oct 20, 2026
Reserved: Apr 16, 2026

Description

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection.

To remediate this issue, users should upgrade to version v3.0.1

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N	AMZN
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N	AMZN

Weaknesses

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected Products

Product	Versions
AWS EFS CSI DriverAmazon	before 3.0.1Affected

References

https://aws.amazon.com/security/security-bulletins/2026-016-aws/vendor-advisory
https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-mph4-q2vm-w2pwthird-party-advisory
https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.0.1patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.