Ghostwire

Home / Vulnerabilities / CVE-2026-6437

CVE-2026-6437: Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver...

Published: April 17, 2026 | Last Modified: April 18, 2026

Description

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users should upgrade to version v3.0.1

Proof-of-Concept Exploits (2)

• kubernetes-sigs/aws-efs-csi-driver
• kubernetes-sigs/aws-efs-csi-driver

Security Coverage (1 articles)

References

• github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-mph4-q2vm
• nvd.nist.gov/vuln/detail/CVE-2026-6437
• github.com/kubernetes-sigs/aws-efs-csi-driver/commit/51806c22c5754bfbdeca6910f15
• aws.amazon.com/security/security-bulletins/2026-016-aws
• github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.0.1
• github.com/advisories/GHSA-mph4-q2vm-w2pw
• www.tenable.com/cve/CVE-2026-6437
• www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-6437