Medium severity6.5GHSA Advisory· Published Apr 17, 2026· Updated Jun 1, 2026
CVE-2026-6437
CVE-2026-6437
Description
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection.
To remediate this issue, users should upgrade to version v3.0.1
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/kubernetes-sigs/aws-efs-csi-driverGo | < 1.7.8-0.20260416142831-51806c22c575 | 1.7.8-0.20260416142831-51806c22c575 |
Affected products
3- Range: < 1.7.8-0.20260416142831-51806c22c575
- ghsa-coordsRange: < 1.7.8-0.20260416142831-51806c22c575
Patches
Vulnerability mechanics
References
7- aws.amazon.com/security/security-bulletins/2026-016-aws/nvdVendor Advisory
- github.com/advisories/GHSA-mph4-q2vm-w2pwghsaADVISORY
- github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-mph4-q2vm-w2pwnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-6437ghsaADVISORY
- aws.amazon.com/security/security-bulletins/2026-016-awsghsaWEB
- github.com/kubernetes-sigs/aws-efs-csi-driver/commit/51806c22c5754bfbdeca6910f15571a07921b784ghsaWEB
- github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.0.1nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.