45 matches found
CVE-2026-85781
A flaw was found in the Amazon EFS Container Storage Interface CSI Driver. When the controller is configured with the non-default --delete-access-point-root-dir=true option, it does not verify that the EFS access point referenced by a PersistentVolume's volumeHandle belongs to the file system...
CLEANSTART-2026-KK52429 Security fix for CVE-2025-1767 applied in: aws-efs-csi-driver 2.2.0-r1, calico-fips 3.31.2-r1, ip-masq-agent 2.12.6-r1, pulumi-kubernetes-operator 2.7.0-r0
CVE-2025-1767 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CVE-2026-85781
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...
CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...
CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...
CVE-2026-85781
The Amazon EFS CSI Driver (kubernetes-sigs/aws-efs-csi-driver) before v3.4.1 is vulnerable to unverified ownership of a storage access point in its volume deletion component. An authenticated Kubernetes user with PersistentVolume creation privileges can craft a PersistentVolume volumeHandle that ...
EUVD-2026-71692
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...
CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...
PT-2026-86236
Name of the Vulnerable Software and Affected Versions Amazon EFS CSI Driver versions prior to v3.4.1 Description The volume deletion component fails to verify the ownership of a storage access point. This allows an authenticated Kubernetes user with PersistentVolume creation privileges to trigger...
CVE-2026-85781: Unverified Ownership
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...
GO-2023-2170 vulnerabilities
Vulnerabilities for packages: aws-efs-csi-driver, aws-efs-csi-driver-fips, kubeflow-pipelines...
GO-2023-2330 vulnerabilities
Vulnerabilities for packages: aws-efs-csi-driver-fips...
GO-2022-0983 vulnerabilities
Vulnerabilities for packages: aws-efs-csi-driver-fips...
GO-2024-2746 vulnerabilities
Vulnerabilities for packages: ip-masq-agent, aws-efs-csi-driver, argocd-image-updater-fips, aws-efs-csi-driver-fips, kubeflow-pipelines, local-static-provisioner, kubernetes-csi-driver-hostpath, argocd-image-updater, spark-operator, rancher-webhook, rancher-webhook-fips, kubernetes,...
GO-2024-3277 vulnerabilities
Vulnerabilities for packages: argocd-image-updater, aws-efs-csi-driver-fips, aws-efs-csi-driver, argocd-image-updater-fips...
GO-2023-2341 vulnerabilities
Vulnerabilities for packages: ip-masq-agent, aws-efs-csi-driver, aws-efs-csi-driver-fips, prometheus-adapter, spark-operator, kubernetes-dns-node-cache, nodetaint, aws-ebs-csi-driver...
GO-2024-2994 vulnerabilities
Vulnerabilities for packages: spark-operator, aws-efs-csi-driver, cri-tools, kubeflow-pipelines, kubernetes-dns-node-cache, ip-masq-agent, nodetaint, k8s-device-plugin, argocd-image-updater, local-static-provisioner, kubernetes-csi-driver-hostpath...
GO-2024-3286 vulnerabilities
Vulnerabilities for packages: aws-efs-csi-driver, kubeflow-pipelines, ip-masq-agent, nodetaint, k8s-device-plugin, argocd-image-updater, local-static-provisioner, kubernetes-dns-node-cache...