Loading story…
AWS disclosed CVE-2026-6437, a mount option injection vulnerability in the Amazon EFS CSI Driver that stems from insufficient input validation before user-controlled values are passed to the operating system's mount helper. In affected versions prior to 3.0.1, Kubernetes PersistentVolume attributes including mounttargetip and volumeHandle can be crafted with injected comma-separated values that the Linux mount process interprets as additional mount options.
Because the driver builds the mount option string directly from those fields and executes with elevated privileges on Kubernetes nodes, an attacker could cause unauthorized mount flags to be applied to the target EFS filesystem during the CSI driver's mount operation. The flaw affects environments using vulnerable EFS CSI Driver releases, and the reported remediation is to upgrade to version 3.0.1 or later.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE report described that affected Amazon EFS CSI Driver versions prior to 3.0.1 insufficiently validate PersistentVolume attributes such as mounttargetip and volumeHandle, allowing injected mount options to influence Linux mount behavior with elevated privileges.
AWS published Security Bulletin 2026-016 for CVE-2026-6437, identifying a mount option injection vulnerability in the Amazon EFS CSI Driver.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon disclosed `CVE-2026-7461`, an OS command injection flaw in the Amazon ECS Agent for Windows that can let a remote authenticated actor execute shell commands as `SYSTEM` on the underlying host. The vulnerability affects ECS agent versions `1.47.0` through `1.102.2` and stems from improper input validation during the mounting of FSx Windows File Server volumes, where a specially crafted username field in an ECS task definition can trigger command execution. The issue is limited to ECS Windows worker instances and does not affect ECS on Fargate. Amazon said exploitation requires the ability to register ECS task definitions or to modify credentials in AWS Secrets Manager or SSM Parameter Store referenced by the FSx volume configuration. The company fixed the flaw in ECS agent version `1.103.0` and advised customers to upgrade to the latest ECS-optimized Windows AMI; as interim mitigations, AWS recommended restricting `ecs:RegisterTaskDefinition` permissions and limiting write access to the affected secrets.
Jun 29, 2026
Two path traversal vulnerabilities, **`CVE-2026-3864`** in the Kubernetes **NFS CSI driver** and **`CVE-2026-3865`** in the **SMB CSI driver**, allow attackers with **`persistentvolumes:create`** permission to escape intended subdirectory boundaries and access other tenants’ data on shared exports. The flaws stem from the drivers trusting attacker-controlled `subDir` values embedded in `PersistentVolume.volumeHandle` fields and relying on Go path handling in ways that did not enforce containment, enabling unauthorized read, write, modification, and deletion of files across shared NFS or SMB storage. Researchers said the issue reflects a broader trust-boundary failure in Kubernetes environments, where requests that are authenticated and authorized by the API are not necessarily safe for privileged components to execute. In some NFS deployments with broader `hostPath` exposure, the bugs could also lead to arbitrary directory deletion on worker nodes. Fixes were released in **NFS CSI Driver `v4.13.1`** and **SMB CSI Driver `v1.20.1`**, while defenders were urged to restrict PersistentVolume creation, tighten RBAC and GitOps service accounts, use admission controls to validate storage parameters, and review similar path-handling patterns across other CSI drivers and cloud-native components.
Jul 24, 2026
A **path traversal vulnerability** in the Kubernetes **CSI Driver for NFS** (`nfs.csi.k8s.io`) could allow attackers with permission to create `PersistentVolume` objects to supply crafted `volumeHandle` values containing `../` sequences in the `subDir` field. During deletion or cleanup operations, the driver may traverse outside the intended managed path and delete or modify unintended directories on the backing NFS server. The issue is tracked as **CVE-2026-3864** and carries a **CVSS 6.5** rating, with impact focused on integrity and availability rather than confidentiality. Affected deployments are those running **CSI Driver for NFS versions prior to `v4.13.1`** while allowing non-administrative or otherwise untrusted users to create PersistentVolumes that reference the NFS CSI driver. Kubernetes guidance says organizations should upgrade to **`v4.13.1` or later**, restrict PersistentVolume creation to trusted administrators, inspect `volumeHandle` values for traversal strings such as `../`, and review controller logs for unexpected directory operations such as references to paths escaping the intended export directory. This is a substantive vulnerability disclosure, not promotional or generic content.
Aug 6, 2026