Aws · Aws-Efs-Csi-Driver · CVE-2026-6437
**Name of the Vulnerable Software and Affected Versions**
AWS EFS CSI Driver versions prior to v3.0.1
**Description**
Improper neutralization of argument delimiters in the volume handling component allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. This occurs because unsanitized values in the `volumeHandle` and `mounttargetip` fields are passed directly to the mount command. The mount utility parses comma-separated values as separate options, enabling an actor to apply unauthorized options to the filesystem mount by appending values to the Access Point ID in `volumeHandle` or to the `mounttargetip` volumeAttribute.
**Recommendations**
Upgrade to version v3.0.1.
Restrict PersistentVolume and StorageClass creation to cluster administrators using Kubernetes RBAC to prevent untrusted users from supplying arbitrary field values.