Storage Access Point Vulnerability in Amazon EFS CSI Driver
CVE-2026-85781

5.1MEDIUM

Key Information:

Vendor

Aws

Status
Aws-efs-csi-driver
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85781?

An unverified ownership issue within the volume deletion component of the Amazon Elastic File System (EFS) Container Storage Interface (CSI) Driver before version 3.4.1 can potentially expose Kubernetes environments to risks. Authenticated users with PersistentVolume creation privileges may exploit this flaw to execute recursive deletions of directories on an EFS filesystem that they do not have permission to access. This can occur by using a crafted PersistentVolume volumeHandle that incorrectly associates an access point from one filesystem to another. To mitigate this risk, it is essential to upgrade to version 3.4.1 of the Amazon EFS CSI Driver.

Affected Version(s)

aws-efs-csi-driver 0 <= 3.4.0

References

https://github.com/kubernetes-sigs/aws-efs-csi-driver/rel...
patchrelease-notes
https://aws.amazon.com/security/security-bulletins/2026-0...
vendor-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.