PT-2026-33485 · Aws · Aws-Efs-Csi-Driver

Shaul Ben-Hai · CVE-2026-6437 · Published 2026-04-17 · Updated 2026-06-01

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AWS EFS CSI Driver versions prior to v3.0.1

Description Improper neutralization of argument delimiters in the volume handling component allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. This occurs because unsanitized values in the volumeHandle and mounttargetip fields are passed directly to the mount command. The mount utility parses comma-separated values as separate options, enabling an actor to apply unauthorized options to the filesystem mount by appending values to the Access Point ID in volumeHandle or to the mounttargetip volumeAttribute.

Recommendations Upgrade to version v3.0.1. Restrict PersistentVolume and StorageClass creation to cluster administrators using Kubernetes RBAC to prevent untrusted users from supplying arbitrary field values.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-6437

GHSA-MPH4-Q2VM-W2PW

Affected Products

Aws-Efs-Csi-Driver

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6437.json · Exploit
• https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.0.1 · Patch
• https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-mph4-q2vm-w2pw · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/2026-016-aws · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mph4-q2vm-w2pw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6437 · Security Note
• https://osv.dev/vulnerability/CVE-2026-6437 · Vendor Advisory
• https://github.com/kubernetes-sigs/aws-efs-csi-driver · Note
• https://github.com/kubernetes-sigs/aws-efs-csi-driver/commit/51806c22c5754bfbdeca6910f15571a07921b784 · Note
• https://twitter.com/_cvereports/status/2049063886855258592 · Twitter Post
• https://t.me/cveNotify/165438 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1sroybx/resumen_diario_de_vulnerabilidades_21042026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1sroqxp/resumen_diario_de_vulnerabilidades_21042026 · Reddit Post
• https://twitter.com/eyalestrin/status/2045530840831348863 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1sro70u/resumen_diario_de_vulnerabilidades_21042026 · Reddit Post