https://seclists.org/oss-sec/2026/q1/322: [kubernetes] CVE-2026-3864: CSI Driver for NFS path traversal via subDir may delete unintended dictories on the NFS server
Published Mar 17, 2026
·Updated
Affected Software
1 affected component
Kubernetes CSI Driver for NFS<v4.13.1
Frequently Asked Questions
1
What is the severity of CVE-2026-3864?
CVE-2026-3864 is considered a critical vulnerability due to its potential to allow attackers to delete unintended directories on the NFS server.
2
How do I fix CVE-2026-3864?
To fix CVE-2026-3864, update to the latest version of the Kubernetes CSI Driver for NFS that addresses the path traversal issue.
3
What vulnerability does CVE-2026-3864 address?
CVE-2026-3864 addresses a path traversal vulnerability in the Kubernetes CSI Driver for NFS which can be exploited through insufficient validation of the subDir parameter.
4
Who is affected by CVE-2026-3864?
Any Kubernetes users utilizing the CSI Driver for NFS with the ability to create PersistentVolumes are potentially affected by CVE-2026-3864.
5
What type of attack does CVE-2026-3864 enable?
CVE-2026-3864 enables an attacker to perform a path traversal attack, which could lead to unauthorized deletion of directories on the NFS server.