---
id: CVE-2026-6437
title: AWS EFS CSI Driver Mount Option Injection
summary: >-
  Improper neutralization of argument delimiters in the volume handling
  component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows
  remote authenticated users with PersistentVolume creation permissions to
  inject arbitrary mou…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-88
vendor: Amazon
product: AWS EFS CSI Driver
affected:
  - aws_efs_csi_driver < 3.0.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-04-17T19:56:39.320224Z'
published: '2026-04-17'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T18:20:23.843Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-6437'
references:
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-016-aws/'
  - url: >-
      https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-mph4-q2vm-w2pw
  - url: 'https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.0.1'
tags:
  - cve.org
epss: 0.00748
epssPercentile: 0.5411
ingestedAt: '2026-10-20T19:16:14.551Z'
---

## Overview

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection.








To remediate this issue, users should upgrade to version v3.0.1

## Affected

- `aws_efs_csi_driver < 3.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.