CVE-2026-85781

Unverified access point ownership in Amazon EFS CSI Driver

State: Published
Severity: 5.1 Medium
Published: Sep 4, 2026
Updated: Sep 4, 2026
Reserved: Sep 4, 2026

Description

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem.

To remediate this issue, users should upgrade to version v3.4.1.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H	AMZN
3.1	8.7 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H	AMZN

Weaknesses

CWE-283 Unverified ownership

Affected Products

Product	Versions
aws-efs-csi-driveraws	3.4.0 and earlierAffected

References

https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.4.1patchrelease-notes
https://aws.amazon.com/security/security-bulletins/2026-099-aws/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.