CVE-2026-103505: AWS EFS CSI Driver Mount Option Injection via mounttargetipmap

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-02
Weakness: CWE-88

Description

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute. To remediate this issue, users should upgrade to version v3.5.0 or later.

Affected products

aws-efs-csi-driver: from 3.1.0 through 3.4.2

References

https://aws.amazon.com/security/security-bulletins/2026-120-aws/
https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.5.0
https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-pv26-6q9q-5773

Get alerted when CVE-2026-103505 or the next vulnerability affects your stack