CVE-2026-3864
A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated.
Published Mar 17, 2026 · updated Jun 17, 2026 · Kubernetes Kubernetes
A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended directories outside the intended managed path within the NFS export. This may lead to deletion or modification of directories on the NFS server.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 17, 2026 · Kubernetes Security
Detected
CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server
Jun 17, 2026 · NIST NVD
Updated
A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended director
Sources
- CVE.orgVulnerability recordCVE-2026-3864
Official CVE identifier
cve.org - Kubernetes SecurityVendor advisoryCVE-2026-3864
CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server
github.com - NIST NVDVulnerability recordCVE-2026-3864
A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path
nvd.nist.gov