{"id":"CVE-2026-6437","title":"AWS EFS CSI Driver Mount Option Injection","summary":"Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mou…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-88"],"vendor":"Amazon","product":"AWS EFS CSI Driver","affected":["aws_efs_csi_driver < 3.0.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-04-17T19:56:39.320224Z"},"published":"2026-04-17","updated":"2026-10-20","sourceUpdated":"2026-10-20T18:20:23.843Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-6437","references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-016-aws/"},{"url":"https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-mph4-q2vm-w2pw"},{"url":"https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.0.1"}],"tags":["cve.org"],"epss":0.00748,"epssPercentile":0.5411,"ingestedAt":"2026-10-20T19:16:14.551Z","slug":"CVE-2026-6437","body":"## Overview\n\nImproper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection.\n\n\n\n\n\n\n\n\nTo remediate this issue, users should upgrade to version v3.0.1\n\n## Affected\n\n- `aws_efs_csi_driver < 3.0.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}