CVE-2026-103505
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute. To remediate this issue, users should upgrade to version v3.5.0 or later.
Risk Assessment
An attacker can inject dangerous mount options, potentially leading to unauthorized data access, privilege escalation, or cluster security compromise.
Recommendation
Upgrade AWS EFS CSI Driver to version v3.5.0 or later, which includes the fix.
Other vulnerabilities in AWS EFS CSI Driver
Original NVD description (English source)
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute. To remediate this issue, users should upgrade to version v3.5.0 or later.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS