Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated us…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 17, 2026 · NIST NVD

   Detected

   Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users should upgrade to version v3.0.1

2. Jun 17, 2026 · NIST NVD

   Updated

   Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users should upgrade to version v3.0.1

Affected

• cpe amazon/efs csi driverversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-6437

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-6437

  Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To reme

  nvd.nist.gov

References

• Vendor Advisory · aws.amazon.com
• Release Notes · github.com
• Vendor Advisory · github.com