Live › vulnerability › CVE-2026-103505
Go to dashboardThe Amazon EFS CSI Driver lets a user who can create PersistentVolumes inject extra mount options through the mounttargetipmap volumeAttribute, because comma-separated values are parsed as separate options. The attacker can change how an EFS volume is mounted on the Kubernetes node.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:43 UTC, 0h before NVD. All times on this page are UTC.
Clusters running Amazon EFS CSI Driver versions and are affected. Exposure depends on whether untrusted users can create PersistentVolumes or StorageClasses that set the mounttargetipmap attribute; clusters where only administrators control storage objects are at much lower risk.
>= v3.1.0<= v3.4.2No product ranges from the sources yet.
kubectl get pods -n kube-system and read the image tag of the efs-csi-controller and efs-csi-node pods.kubectl auth can-i create persistentvolumes --all-namespaces and review the RBAC bindings.v3.5.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-103505 - Mount Option Injection in Amazon EFS CSI Driver
Bulletin ID: 2026-120-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 08:30 AM PDT
Description:
The Amazon EFS CSI Driver is a Container Storage Interface driver that allows Kubernetes clusters to use Amazon Elastic File System. We identified CVE-2026-103505, where an actor with PersistentVolume creation privileges can inject additional mount options through the mounttargetipmap volumeAttribute. Appending comma-separated values to a value inside that JSON map causes the mount utility to parse them as separate mount options.
Impacted versions: >= v3.1.0 AND <= v3.4.2
Resolution:
This issue has been addressed in Amazon EFS CSI Driver version v3.5.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
Restrict PersistentVolume and StorageClass creation to cluster administrators using Kubernetes RBAC, preventing untrusted users from supplying arbitrary field values.
References:
Please email [email protected] with any security questions or concerns..
This page as .md · .json · in your agent: get_signal("CVE-2026-103505")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.