{"id":"EUVD-2026-23500","enisaUuid":"af374585-31c4-3078-afcd-b7cb6dd36ea2","description":"Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection.\n\n\n\n\n\n\n\n\nTo remediate this issue, users should upgrade to version v3.0.1","datePublished":"Apr 17, 2026, 6:41:36 PM","dateUpdated":"Oct 20, 2026, 6:20:23 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N","references":"https://aws.amazon.com/security/security-bulletins/2026-016-aws/\nhttps://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-mph4-q2vm-w2pw\nhttps://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.0.1\n","aliases":"CVE-2026-6437\n","assigner":"AMZN","epss":0.57,"enisaIdProduct":[{"id":"2af8f8b3-3250-3865-8136-ba790e26899a","product":{"name":"AWS EFS CSI Driver","vendor":{"name":"Amazon"}},"product_version":"0 \u003c3.0.1"}],"enisaIdVendor":[{"id":"43d43256-d38a-36ca-952e-824c126b3252","vendor":{"name":"Amazon"}}],"enisaIdVulnerability":[{"id":"58490ec9-73ab-326c-abff-1808922cbfeb","vulnerability":{"id":"CVE-2026-6437","description":"Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection.\n\n\n\n\n\n\n\n\nTo remediate this issue, users should upgrade to version v3.0.1","datePublished":"Apr 17, 2026, 6:41:36 PM","dateUpdated":"Oct 20, 2026, 6:20:23 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N","references":"https://aws.amazon.com/security/security-bulletins/2026-016-aws/\nhttps://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-mph4-q2vm-w2pw\nhttps://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.0.1\n","enisa_id":"EUVD-2026-23500\n","assigner":"AMZN","epss":0.57,"dataProcessed":"Nov 1, 2026, 7:18:17 AM","vulnerabilityProduct":[{"id":"acaee7b5-4056-3a38-a748-eae9614cc8f3","product":{"name":"AWS EFS CSI Driver","vendor":{"name":"Amazon"}},"product_version":"0 \u003c3.0.1"}],"vulnerabilityVendor":[{"id":"6e9d1e66-5381-3ce6-9f45-bae632db0275","vendor":{"name":"Amazon"}}]}}],"enisaIdAdvisory":[]}