CVE-2026-6437
6.5 MEDIUMImproper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 ...
Published: 2026-04-17 · Last updated: 2026-06-01
Severity and scoring
- CVSS
- 6.5 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- CWE
- CWE-88
Affected products
| Vendor | Product |
|---|---|
| amazon | efs_csi_driver |
Description
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users should upgrade to version v3.0.1
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-6437
- [Vendor advisory]https://aws.amazon.com/security/security-bulletins/2026-016-aws/
- [Other]https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.0.1
- [Vendor advisory]https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-mph4-q2vm-w2pw
Related CVEs
Same vendor
- CVE-2026-10591 — Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated... (8.8 HIGH)
- CVE-2026-9255 — Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker to execute arbitrary t... (7.8 HIGH)
- CVE-2026-31431 — In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly r... (7.8 HIGH)
- CVE-2026-5747 — An out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allo... (7.5 HIGH)
- CVE-2026-4270 — Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.... (5.5 MEDIUM)
Same CWE
- CVE-2026-46529 — Atril Document Viewer is the default document reader of the MATE desktop environment for Linux
- CVE-2026-53694 — Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Nomachine allows Argument Injection.T...
- CVE-2026-52750 — Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not ... (7.8 HIGH)
- CVE-2026-11332 — A flaw was found in ansible-core (7.8 HIGH)
- CVE-2026-41013 — Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privileged CF space developer to... (8.1 HIGH)