CVE-2026-103505
Received Received - Intake

Volume Mount Option Injection in AWS EFS CSI Driver

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: AMZN

Description
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute. To remediate this issue, users should upgrade to version v3.5.0 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-103505
EUVD
EUVD-2026-90883

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
amazon aws_efs_csi_driver to 3.4.2 (inc)
amazon aws_efs_csi_driver 3.5.0
amazon aws_efs_csi_driver From 3.1.0 (inc) to 3.4.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper neutralization of argument delimiters in the volume handling component of AWS EFS CSI Driver versions 3.1.0 through 3.4.2. It allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute.

Detection Guidance

To detect this vulnerability, check the version of the AWS EFS CSI Driver in your Kubernetes cluster. Run: kubectl get daemonset -n kube-system -l app=efs-csi-controller -o jsonpath='{.items[0].spec.template.spec.containers[0].image}'

Impact Analysis

An attacker with PersistentVolume creation permissions could inject malicious mount options, potentially leading to unauthorized access to sensitive data or privilege escalation within the Kubernetes cluster.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access or privilege escalation through mount option injection. If exploited, it may lead to unauthorized data access or modification, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade the AWS EFS CSI Driver to version v3.5.0 or later. Additionally, restrict PersistentVolume and StorageClass creation permissions to cluster administrators using Kubernetes RBAC.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103505. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart