CVE-2026-6437CWE-88

CVE-2026-6437

Medium · published April 17, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
54.4
In the wild
Unconfirmed
What it is

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection.

To remediate this issue, users should upgrade to version v3.0.1

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00748 · 54.4th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-04-17T23:16Z
Affected products (1)
ProductVersionsFixed in
amazon/efs_csi_driver< 3.0.13.0.1
References (3)
https://aws.amazon.com/security/security-bulletins/2026-016-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.0.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-mph4-q2vm-w2pw · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 17 APR 18:41Z
    AWS EFS CSI Driver Mount Option Injection
    cvelistv5