CVE-2026-85781
Received Received - Intake

Directory Traversal in Amazon EFS CSI Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: AMZN

Description
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem. To remediate this issue, users should upgrade to version v3.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85781
EUVD
EUVD-2026-71692

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
amazon efs_csi_driver 3.4.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-283 The product does not properly verify that a critical resource is owned by the proper entity.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Amazon EFS CSI Driver before v3.4.1 where an authenticated Kubernetes user with PersistentVolume creation privileges could exploit unverified ownership of a storage access point during volume deletion. By crafting a PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem, the user could cause recursive deletion of directories on an unauthorized EFS filesystem.

Impact Analysis

An attacker with PersistentVolume creation privileges could delete directories on EFS filesystems they are not authorized to access, leading to data loss or disruption of services relying on those filesystems. This could affect the integrity and availability of data stored in the affected EFS filesystems.

Compliance Impact

This vulnerability could lead to unauthorized data deletion, potentially violating data integrity and availability requirements under GDPR and HIPAA. Unauthorized access or deletion of sensitive data may result in non-compliance with these regulations, leading to legal and financial penalties.

Mitigation Strategies

Upgrade the Amazon EFS CSI Driver to version v3.4.1 or later to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85781. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart