CVE-2026-103505

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the...

EUVD-2026-90883

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the...

CVE-2026-103505 AWS EFS CSI Driver Mount Option Injection via mounttargetipmap

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the...

CVE-2026-103505

The AWS EFS CSI Driver (aws-efs-csi-driver ) versions v3.1.0 through v3.4.2 are vulnerable to an improper neutralization of argument delimiters within the volume handling component. This flaw could allow remote authenticated users who possess PersistentVolume creation permissions to inject arbitr...

CVE-2026-85781

A flaw was found in the Amazon EFS Container Storage Interface CSI Driver. When the controller is configured with the non-default --delete-access-point-root-dir=true option, it does not verify that the EFS access point referenced by a PersistentVolume's volumeHandle belongs to the file system...

CLEANSTART-2026-GK32867 Security fix for CVE-2026-1703 applied in: k8s-sidecar 1.25.2-r0, kubernetes-csi-driver-nfs-fips 4.13.0-r0, python3 3.11.14-r0, python3 3.12.12-r0

CVE-2026-1703 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KK52429 Security fix for CVE-2025-1767 applied in: aws-efs-csi-driver 2.2.0-r1, calico-fips 3.31.2-r1, ip-masq-agent 2.12.6-r1, pulumi-kubernetes-operator 2.7.0-r0

CVE-2025-1767 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

GHSA-QC2Q-P7WX-3PX3 vulnerabilities

Vulnerabilities for packages: mcp-grafana, falco-exporter, gcp-compute-persistent-disk-csi-driver, secrets-store-csi-driver-provider-azure, k8s-device-plugin, calico, rancher-agent, cloudflared, bank-vaults, flyte, knative-serving, cerbos, kubeflow-pipelines, kuma, opentofu, grafana-mimir, argo-c...

CVE-2026-84303 vulnerabilities

Vulnerabilities for packages: mcp-grafana, falco-exporter, gcp-compute-persistent-disk-csi-driver, secrets-store-csi-driver-provider-azure, k8s-device-plugin, calico, rancher-agent, cloudflared, bank-vaults, flyte, knative-serving, cerbos, kubeflow-pipelines, kuma, opentofu, grafana-mimir, argo-c...

CVE-2026-85781

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

EUVD-2026-71692

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

CVE-2026-85781

The Amazon EFS CSI Driver (kubernetes-sigs/aws-efs-csi-driver) before v3.4.1 is vulnerable to unverified ownership of a storage access point in its volume deletion component. An authenticated Kubernetes user with PersistentVolume creation privileges can craft a PersistentVolume volumeHandle that ...

CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

PT-2026-86236

Name of the Vulnerable Software and Affected Versions Amazon EFS CSI Driver versions prior to v3.4.1 Description The volume deletion component fails to verify the ownership of a storage access point. This allows an authenticated Kubernetes user with PersistentVolume creation privileges to trigger...

CVE-2026-85781: Unverified Ownership

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

CLEANSTART-2026-ZB55594 Security fixes in secrets-store-csi-driver-provider-gcp 1.17.0-r2

Package secrets-store-csi-driver-provider-gcp version 1.17.0-r2 fixes 20 vulnerabilities: CVE-2026-42508, CVE-2026-39835, CVE-2026-46598, CVE-2026-39828, CVE-2026-39829...

CLEANSTART-2026-PP35477 Security fixes in secrets-store-csi-driver-provider-gcp 1.17.0-r1

Package secrets-store-csi-driver-provider-gcp version 1.17.0-r1 fixes 20 vulnerabilities: CVE-2026-42508, CVE-2026-39835, CVE-2026-46598, CVE-2026-39828, CVE-2026-39829...

GO-2026-6091 vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-auth, cri-tools, trufflehog, gcp-compute-persistent-disk-csi-driver, envconsul, cluster-api-azure-controller, cloudflared, terraform-provider-google, kube-metrics-adapter, tetragon, syft, cilium-cli, verticadb-operator, dagdotdev, step, cerbos, kine,...