{"id":"CVE-2026-6437","summary":"AWS EFS CSI Driver Mount Option Injection","details":"Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection.\n\n\n\n\nTo remediate this issue, users should upgrade to version v3.0.1","aliases":["GHSA-mph4-q2vm-w2pw"],"modified":"2026-08-05T03:32:18.950348312Z","published":"2026-04-17T18:41:36.075Z","database_specific":{"cwe_ids":["CWE-88"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6437.json","cna_assigner":"AMZN"},"references":[{"type":"ADVISORY","url":"https://aws.amazon.com/security/security-bulletins/2026-016-aws/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6437.json"},{"type":"ADVISORY","url":"https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-mph4-q2vm-w2pw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6437"},{"type":"FIX","url":"https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.0.1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kubernetes-sigs/aws-efs-csi-driver","events":[{"introduced":"0"},{"fixed":"67e06b12c312c29b8e97abb0001eee3f0a520365"}],"database_specific":{"cpe":"cpe:2.3:a:amazon:efs_csi_driver:*:*:*:*:*:kubernetes:*:*","extracted_events":[{"introduced":"0"},{"fixed":"v3.0.1"},{"fixed":"3.0.1"}],"source":["DESCRIPTION","CPE_RANGE","REFERENCES"]}}],"versions":["v3.0.0","helm-chart-aws-efs-csi-driver-4.0.0","helm-chart-aws-efs-csi-driver-3.3.0","helm-chart-aws-efs-csi-driver-3.2.2","helm-chart-aws-efs-csi-driver-3.2.6","helm-chart-aws-efs-csi-driver-3.2.5","helm-chart-aws-efs-csi-driver-3.2.4","helm-chart-aws-efs-csi-driver-3.2.3","helm-chart-aws-efs-csi-driver-3.2.1","helm-chart-aws-efs-csi-driver-3.2.0","helm-chart-aws-efs-csi-driver-3.1.9","helm-chart-aws-efs-csi-driver-3.1.8","v2.1.7","helm-chart-aws-efs-csi-driver-3.1.7","v2.1.6","helm-chart-aws-efs-csi-driver-3.1.6","v2.1.5","helm-chart-aws-efs-csi-driver-3.1.5","v2.1.4","helm-chart-aws-efs-csi-driver-3.1.4","v2.1.3","helm-chart-aws-efs-csi-driver-3.1.3","v2.1.2","helm-chart-aws-efs-csi-driver-3.1.2","v2.1.1","helm-chart-aws-efs-csi-driver-3.1.1","v2.1.0","v2.0.9","v2.0.8","helm-chart-aws-efs-csi-driver-3.0.8","helm-chart-aws-efs-csi-driver-3.0.7","helm-chart-aws-efs-csi-driver-3.0.6","v2.0.5","helm-chart-aws-efs-csi-driver-3.0.5","v2.0.4","helm-chart-aws-efs-csi-driver-3.0.4","v2.0.3","helm-chart-aws-efs-csi-driver-3.0.3","v2.0.2","helm-chart-aws-efs-csi-driver-3.0.2","helm-chart-aws-efs-csi-driver-3.0.1","v2.0.1","helm-chart-aws-efs-csi-driver-3.0.0","v2.0.0","helm-chart-aws-efs-csi-driver-2.5.7","helm-chart-aws-efs-csi-driver-2.5.6","helm-chart-aws-efs-csi-driver-2.5.5","helm-chart-aws-efs-csi-driver-2.5.4","helm-chart-aws-efs-csi-driver-2.5.3","helm-chart-aws-efs-csi-driver-2.5.2","helm-chart-aws-efs-csi-driver-2.5.1","helm-chart-aws-efs-csi-driver-2.5.0","v1.7.0","helm-chart-aws-efs-csi-driver-2.4.9","helm-chart-aws-efs-csi-driver-2.4.8","helm-chart-aws-efs-csi-driver-2.4.7","helm-chart-aws-efs-csi-driver-2.4.6","helm-chart-aws-efs-csi-driver-2.4.5","helm-chart-aws-efs-csi-driver-2.4.4","helm-chart-aws-efs-csi-driver-2.4.3","helm-chart-aws-efs-csi-driver-2.4.2","helm-chart-aws-efs-csi-driver-2.4.1","helm-chart-aws-efs-csi-driver-2.4.0","helm-chart-aws-efs-csi-driver-2.3.9","helm-chart-aws-efs-csi-driver-2.3.8","helm-chart-aws-efs-csi-driver-2.3.7","helm-chart-aws-efs-csi-driver-2.3.6","helm-chart-aws-efs-csi-driver-2.3.5","helm-chart-aws-efs-csi-driver-2.3.4","helm-chart-aws-efs-csi-driver-2.3.3","helm-chart-aws-efs-csi-driver-2.3.2","helm-chart-aws-efs-csi-driver-2.3.1","helm-chart-aws-efs-csi-driver-2.3.0","helm-chart-aws-efs-csi-driver-2.2.9","helm-chart-aws-efs-csi-driver-2.2.8","helm-chart-aws-efs-csi-driver-2.2.7","helm-chart-aws-efs-csi-driver-2.2.5","helm-chart-aws-efs-csi-driver-2.2.4","helm-chart-aws-efs-csi-driver-2.2.2","helm-chart-aws-efs-csi-driver-1.0.0","v1.0.0","v0.3.0-rc0","v0.3.0","v0.2.0","v0.2.0-rc0","v0.1.0","v0.1.0-rc0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6437.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N"}]}