EUVD-2026-90883
GHSA-9w9f-p9qm-rcm4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain PersistentVolume-create RBAC rights
-
DeliveryCraft PV with malicious mounttargetipmap value
-
ExploitInject extra mount options via comma delimiters
-
ExecutionDriver mounts EFS with attacker-controlled options
-
ImpactAccess or alter node filesystem state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Argument sanitization
|
| Exploitation Conditions | Exploitation requires an authenticated Kubernetes user or service account that already holds PersistentVolume creation permissions (a privileged RBAC grant), plus a cluster running aws-efs-csi-driver v3.1.0 through v3.4.2. The specific vector is injecting additional, comma-separated tokens into the mounttargetipmap volumeAttribute of a PV so they are interpreted as extra mount options. Limiting factors: the attacker must be authorized to create PersistentVolumes (PR:H), the vulnerable driver version must be deployed, and no end-user interaction is involved; upgrading to v3.5.0 removes the condition. |
| Impact | This is a moderate-priority issue, not an emergency. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N = 6.5 MEDIUM) is the only scoring signal and appears well-calibrated. The decisive limiter is PR:H: exploitation requires an authenticated principal that already holds Kubernetes PersistentVolume creation permissions - a privileged RBAC capability typically granted to cluster/storage administrators, not ordinary workload users. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or imminent widespread exploitation. The high C:H/I:H impact reflects that arbitrary mount options can expose or alter node-level filesystem state, but the privilege barrier keeps this squarely in the insider/privilege-abuse and lateral-movement category rather than broad remote compromise. No conflicting signals between the vector and description were found: both agree on network-reachable API input (the volumeAttribute) under an authenticated, authorized actor. |
| Exploit ScenarioDerived | An authenticated user (or compromised service account) that holds PersistentVolume creation rights in a Kubernetes cluster crafts a PV referencing the AWS EFS CSI Driver and supplies a malicious comma-separated value in the mounttargetipmap volumeAttribute. Because argument delimiters are not neutralized (CWE-88), the extra comma-separated tokens are passed through as additional mount options, letting the attacker influence how the EFS volume is mounted on the node. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Argument injection in the AWS EFS CSI Driver v3.1.0 through v3.4.2 allows an authenticated Kubernetes user or service account that already holds PersistentVolume creation permissions to smuggle extra mount options into an EFS mount by embedding comma-separated tokens in a PersistentVolume's mounttargetipmap volumeAttribute. Because the driver fails to neutralize the argument delimiter, injected tokens are parsed as additional mount flags, giving high confidentiality and integrity impact along the container storage path, while availability is not affected under the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N (6.5). No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has shipped v3.5.0 to remove the condition.
RemediationAI
Upgrade the driver to v3.5.0 or later, which is the vendor-released fix (release notes at https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.5.0, advisory at https://aws.amazon.com/security/security-bulletins/2026-120-aws/); if the cluster is managed through the AWS EFS CSI add-on or Helm, update the chart/add-on version and confirm the deployed image tag reports v3.5.0 or higher. Where immediate upgrade is not possible, the most effective compensating control is to tighten RBAC so that PersistentVolume creation is limited to a small set of trusted cluster administrators and service accounts, which directly removes the PR:H prerequisite but has the trade-off of slowing legitimate self-service storage provisioning and potentially breaking automation that creates PVs. A second option is a validating admission policy (e.g. a ValidatingAdmissionPolicy or OPA/Gatekeeper constraint) that rejects any PersistentVolume whose efs volumeAttributes.mounttargetipmap contains a comma or unexpected option-like token; this blocks the injection vector without a driver restart but requires policy maintenance and can break legitimate multi-target mappings that rely on comma-separated values. Auditing existing PersistentVolume objects for suspicious mounttargetipmap values is also advisable to detect prior abuse attempts. Note that no public exploit code or confirmed active exploitation was identified at time of analysis, so these controls can be sequenced with the normal patch cycle rather than emergency change windows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic CWE-88 improper neutralization of argument delimiters (argument injection). The AWS EFS CSI Driver is a CSI node/controller plugin that translates Kubernetes PersistentVolume specifications into EFS mount operations; the mounttargetipmap volumeAttribute is consumed by the volume handling component and ultimately concatenated into the mount option string handed to the mount helper. Mount option strings use the comma as the option separator, so any unescaped comma contained in an attacker-controlled attribute value terminates the intended token and starts a new, attacker-chosen option. The CPE record cpe:2.3:a:aws:aws-efs-csi-driver:*:*:*:*:*:*:*:* is version-wildcarded at the vendor level, but the CVE description scopes the defect to releases 3.1.0 through 3.4.2. The CVSS vector's PR:H reflects that PersistentVolume creation is itself a highly privileged Kubernetes RBAC permission, so the attacker is authenticated and already high-privileged inside the cluster; UI:N indicates no user interaction is required.
Know when AWS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N
PV-creation is a privileged RBAC capability so PR:H; injection is reliable via a simple API field (AC:L), reached over the cluster API (AV:N), and mount-option control yields high C/I but no availability impact.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute.
To remediate this issue, users should upgrade to version v3.5.0 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in the aws-smithy-json Rust runtime crate (versions before 0.62.7) lets remote unauthenticated attacke
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to
Exploit-DB