CVE-2026-6437 Details
Description
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users should upgrade to version v3.0.1
A vulnerability in the AWS EFS CSI Driver prior to version 3.0.1 allows remote authenticated users with permissions to create PersistentVolumes to inject arbitrary mount options through comma-separated values. This injection occurs via two unsanitized fields: the Access Point ID in volumeHandle and the mounttargetip volumeAttribute. The mount utility interprets the injected values as separate options, which are then applied to the filesystem mount without proper authorization.
Users should upgrade to AWS EFS CSI Driver version 3.0.1 or later. For those using a forked or derivative version of the driver, ensure that it is patched to include the latest fixes.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://aws.amazon.com/security/security-bulletins/2026-016-aws/ | AMZN | Vendor Advisory |
| https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.0.1 | AMZN | Release Notes |
| https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-mph4-q2vm-w2pw | AMZN | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | AMZN |
Affected Products
| Product | Versions |
|---|---|
| amazon efs csi driver | < 3.0.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | AMZN |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| Apr 17, 2026 | New CVE Received | AMZN |