CVE-2026-6437 MEDIUM

CVE-2026-6437: AWS EFS CSI Driver Mount Option Injection

Weakness CWE-88

Published April 17, 2026

Last update April 17, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users should upgrade to version v3.0.1

Key dates

02Disclosure timeline

April 17, 2026 CVE published

April 17, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-6437 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/88.html

Related vulnerabilities

04Related CVE

CVE-2026-43893 exiftool-vendored: Argument injection via newline characters in tag names CVE-2023-6269 Argument injection vulnerability in Atos Unify OpenScape Session Border Controller, Atos Unify OpenScape Branch and Atos Unify OpenScape BCF CVE-2025-46835 Git GUI can create and overwrite files for which the user has write permission CVE-2025-52480 Registrator.jl Argument Injection Vulnerability CVE-2026-26194 Gogs: Release tag option injection in release deletion