CVE-2026-85781: Unverified access point ownership in Amazon EFS CSI Driver
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem.
To remediate this issue, users should upgrade to version v3.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon EFS CSI Driverto a version that resolves this vulnerability.Fixed in v3.4.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Kubernetes user needs privileges to create PersistentVolume resources. The issue is relevant where such a user can submit a crafted volumeHandle to the EFS CSI Driver.
What is required for the deletion to affect another EFS filesystem?
The attacker must craft a PersistentVolume volumeHandle that combines an access point from one filesystem with a different target filesystem. This can cause recursive directory deletion on an EFS filesystem the user is not authorized to access.
Which versions are affected and what is the remediation?
Versions before 3.4.1 are affected. Upgrade the Amazon EFS CSI Driver to version 3.4.1.