Loading story…
A path traversal vulnerability in the Kubernetes CSI Driver for NFS (nfs.csi.k8s.io) could allow attackers with permission to create PersistentVolume objects to supply crafted volumeHandle values containing ../ sequences in the subDir field. During deletion or cleanup operations, the driver may traverse outside the intended managed path and delete or modify unintended directories on the backing NFS server. The issue is tracked as CVE-2026-3864 and carries a CVSS 6.5 rating, with impact focused on integrity and availability rather than confidentiality.
Affected deployments are those running CSI Driver for NFS versions prior to v4.13.1 while allowing non-administrative or otherwise untrusted users to create PersistentVolumes that reference the NFS CSI driver. Kubernetes guidance says organizations should upgrade to v4.13.1 or later, restrict PersistentVolume creation to trusted administrators, inspect volumeHandle values for traversal strings such as ../, and review controller logs for unexpected directory operations such as references to paths escaping the intended export directory. This is a substantive vulnerability disclosure, not promotional or generic content.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A Kubernetes product advisory was published documenting CVE-2026-3864, a path traversal issue in the CSI Driver for NFS. The advisory formalized the disclosure and identified the risk of unintended directory deletion on NFS servers.
Kubernetes maintainers Andy Zhang and Rita Zhang released a fix for CVE-2026-3864 in CSI Driver for NFS version 4.13.1. The vulnerability affects versions prior to v4.13.1 and could allow users able to create PersistentVolumes for nfs.csi.k8s.io to delete or modify unintended directories on the NFS server via ../ traversal sequences.
Shaul Ben Hai of SentinelOne identified a path traversal vulnerability in the Kubernetes CSI Driver for NFS involving insufficient validation of the subDir parameter in volume identifiers. The issue was responsibly disclosed to the Kubernetes project and handled with the Kubernetes Security Response Committee.
Kubernetes maintainers patched a path traversal vulnerability in the SMB CSI driver, tracked as CVE-2026-3865. The flaw was structurally similar to CVE-2026-3864 in the NFS CSI driver and could let an attacker with permission to create PersistentVolume objects manipulate filesystem paths on remote SMB shares.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
linuxsecurity.com
Open sourcecybersecuritynews.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two path traversal vulnerabilities, **`CVE-2026-3864`** in the Kubernetes **NFS CSI driver** and **`CVE-2026-3865`** in the **SMB CSI driver**, allow attackers with **`persistentvolumes:create`** permission to escape intended subdirectory boundaries and access other tenants’ data on shared exports. The flaws stem from the drivers trusting attacker-controlled `subDir` values embedded in `PersistentVolume.volumeHandle` fields and relying on Go path handling in ways that did not enforce containment, enabling unauthorized read, write, modification, and deletion of files across shared NFS or SMB storage. Researchers said the issue reflects a broader trust-boundary failure in Kubernetes environments, where requests that are authenticated and authorized by the API are not necessarily safe for privileged components to execute. In some NFS deployments with broader `hostPath` exposure, the bugs could also lead to arbitrary directory deletion on worker nodes. Fixes were released in **NFS CSI Driver `v4.13.1`** and **SMB CSI Driver `v1.20.1`**, while defenders were urged to restrict PersistentVolume creation, tighten RBAC and GitOps service accounts, use admission controls to validate storage parameters, and review similar path-handling patterns across other CSI drivers and cloud-native components.
Jul 24, 2026
AWS disclosed **CVE-2026-6437**, a mount option injection vulnerability in the Amazon EFS CSI Driver that stems from insufficient input validation before user-controlled values are passed to the operating system's mount helper. In affected versions prior to `3.0.1`, Kubernetes `PersistentVolume` attributes including `mounttargetip` and `volumeHandle` can be crafted with injected comma-separated values that the Linux mount process interprets as additional mount options. Because the driver builds the mount option string directly from those fields and executes with elevated privileges on Kubernetes nodes, an attacker could cause unauthorized mount flags to be applied to the target EFS filesystem during the CSI driver's mount operation. The flaw affects environments using vulnerable EFS CSI Driver releases, and the reported remediation is to upgrade to version `3.0.1` or later.
Jun 29, 2026
Tenable disclosed a critical path traversal vulnerability, tracked as **`CVE-2026-15265`**, affecting **Tenable/Nessus Agent** on **Linux, Windows, and macOS**. The flaw allows a privileged attacker to write arbitrary files outside the intended plugin directory, creating a path to **remote code execution**. The issue affects **version 11.2.0** and **11.1.3 and earlier**, and has been classified under **`CWE-22`** and **`CWE-347`** with high impact to confidentiality, integrity, and availability. Tenable released fixes in **versions 11.2.1 and 11.1.4**, and the **Canadian Centre for Cyber Security** issued advisory **AV26-705** urging organizations to review Tenable’s guidance and apply updates. CISA enrichment cited in vulnerability tracking data indicates **no known exploitation** so far, but assessed the technical impact as total, reinforcing the need for rapid patching across exposed agent deployments.
Jul 16, 2026