Recursive dir deletion via crafted PV volumeHandle in EFS CSI Driver <v3.4.1
CVE-2026-85781 Published on September 4, 2026
Unverified access point ownership in Amazon EFS CSI Driver
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem.
To remediate this issue, users should upgrade to version v3.4.1.
Vulnerability Analysis
CVE-2026-85781 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Unverified Ownership
The software does not properly verify that a critical resource is owned by the proper entity.
Products Associated with CVE-2026-85781
stack.watch emails you whenever new vulnerabilities are published in Aws Efs Csi Driver or Amazon Aws. Just hit a watch button to start following.
Affected Versions
aws-efs-csi-driver:- Before and including 3.4.0 is affected.