CVE-2026-103505

6.5 MEDIUMpublic exploit available

Published 2026-10-01 · Updated 2026-10-02

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute. To remediate this issue, users should upgrade to version v3.5.0 or later.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-88

Public exploit & PoC references

https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.5.0
https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-pv26-6q9q-5773

All references

https://aws.amazon.com/security/security-bulletins/2026-120-aws/
https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.5.0
https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-pv26-6q9q-5773

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-100369PoC
HIGHCVE-2026-100561PoC
HIGHCVE-2026-100570PoC
CRITICALCVE-2026-100714PoC
HIGHCVE-2026-102827PoC
MEDIUMCVE-2026-102904PoC
HIGHCVE-2026-104715
LOWCVE-2026-105326PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.