CVE-2026-103505
Public on 2026-10-01
Modified on 2026-10-03
Description
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute.
To remediate this issue, users should upgrade to version v3.5.0 or later.
To remediate this issue, users should upgrade to version v3.5.0 or later.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Core | amazon-efs-utils | Not Affected | ||
| Amazon Linux 2023 | amazon-efs-utils | Not Affected | ||
| Amazon Linux 2027 Preview | amazon-efs-utils | Not Affected |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |