CVE-2026-103505: AWS EFS CSI Driver Mount Option Injection via mounttargetipmap
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute.
To remediate this issue, users should upgrade to version v3.5.0 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aws-efs-csi-driverto a version that resolves this vulnerability.Fixed in v3.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated remote user who has permission to create PersistentVolume resources can exploit it. The issue is therefore primarily relevant in Kubernetes environments where those permissions are granted to untrusted or insufficiently trusted users or workloads.
What input is used to inject mount options?
The attacker supplies comma-separated values in the mounttargetipmap volumeAttribute. The vulnerable driver versions do not properly neutralize argument delimiters in that value, allowing arbitrary mount options to be injected.
Which versions need to be remediated?
AWS EFS CSI Driver versions v3.1.0 through v3.4.2 are affected. Upgrade to v3.5.0 or later.
What can be done if an immediate upgrade is not possible?
Restrict PersistentVolume creation permissions to trusted principals, since those permissions are required for exploitation. Review and limit who can set the mounttargetipmap volumeAttribute in PersistentVolume definitions.