CVE-2026-85781

A flaw was found in the Amazon EFS Container Storage Interface CSI Driver. When the controller is configured with the non-default --delete-access-point-root-dir=true option, it does not verify that the EFS access point referenced by a PersistentVolume's volumeHandle belongs to the file system...

CVE-2026-85781

The Amazon EFS CSI Driver (kubernetes-sigs/aws-efs-csi-driver) before v3.4.1 is vulnerable to unverified ownership of a storage access point in its volume deletion component. An authenticated Kubernetes user with PersistentVolume creation privileges can craft a PersistentVolume volumeHandle that ...

CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...