Medium severity · published Apr 17, 2026
CVE-2026-6437
AWS EFS CSI Driver Mount Option Injection
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection.
To remediate this issue, users should upgrade to version v3.0.1
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
AWS EFS CSI Driver · Amazon
before 3.0.1 · source: vendor
EC
Efs Csi Driver · Amazon
before 3.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6437
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6437
Vendor Advisory
https://aws.amazon.com/security/security-bulletins/2026-016-aws/
Release Notes
https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.0.1
Vendor Advisory
https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-mph4-q2vm-w2pw