ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-3864

A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated.

Published Mar 17, 2026 · catalog updated Jun 17, 2026 · Kubernetes Kubernetes

Check if you run it

No confirmed exploitation is on record for CVE-2026-3864. EPSS is 0.84%. Act only if a listed version of Kubernetes Kubernetes is installed.

Gaps on this record

  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.84%
Remediation
Advisory link
Affected products
Kubernetes Kubernetes

A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended directories outside the intended managed path within the NFS export. This may lead to deletion or modification of directories on the NFS server.

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.

How to fix CVE-2026-3864

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-3864. EPSS is 0.84%. Act only if a listed version of Kubernetes Kubernetes is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-22: Path Traversal. EPSS 0.84%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Kubernetes security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 17, 2026 · Kubernetes Security

    Detected

    CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server

  2. Jun 17, 2026 · NIST NVD

    Updated

    A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended director

Sources

  • CVE.orgVulnerability recordCVE-2026-3864

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-3864

    30-day exploitation probability 0.8%

    first.org
  • Kubernetes SecurityVendor advisoryCVE-2026-3864

    CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server

    github.com
  • NIST NVDVulnerability recordCVE-2026-3864

    A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.