CVE-2026-103505: AWS EFS CSI Driver RCE Vulnerability

CVE-2026-103505 Overview

CVE-2026-103505 is an argument injection vulnerability [CWE-88] in the AWS Elastic File System Container Storage Interface (EFS CSI) Driver, affecting versions v3.1.0 through v3.4.2. The flaw resides in the volume handling component, which fails to neutralize comma-separated argument delimiters inside the mounttargetipmapvolumeAttribute. Authenticated users with Kubernetes PersistentVolume creation permissions can inject arbitrary mount options into the EFS mount command. The issue is tracked in GitHub Security Advisory GHSA-pv26-6q9q-5773 and in AWS Security Bulletin 2026-120.

Critical Impact

Authenticated Kubernetes users with PersistentVolume creation rights can inject arbitrary mount options, enabling tampering with cluster node mounts and potential lateral impact on other workloads.

Affected Products

• AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0
• AWS EFS CSI Driver versions v3.2.x through v3.4.2
• Kubernetes clusters consuming EFS volumes via affected driver releases

Discovery Timeline

• 2026-10-01 - CVE-2026-103505 published to the National Vulnerability Database
• 2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-103505

Vulnerability Analysis

The AWS EFS CSI Driver provisions and mounts Amazon EFS file systems inside Kubernetes pods. During volume attachment, the driver reads volumeAttributes from the PersistentVolume specification and uses them to construct the backing mount command on the node. The mounttargetipmap attribute accepts a mapping of availability zones to mount target IP addresses as a comma-separated string.

The driver passes values from this field into the mount invocation without filtering embedded commas or option delimiters. Because the mount command treats commas as option separators, an attacker who controls the volumeAttributes can append additional mount flags after a legitimate value. The injected flags are executed with the privileges of the node-level CSI driver, which runs as root.

Root Cause

The root cause is improper neutralization of argument delimiters [CWE-88] in the parser that constructs mount options from the mounttargetipmap field. The driver trusts user-supplied volumeAttributes and does not escape or reject comma characters that extend the argument list beyond the intended IP mapping.

Attack Vector

Exploitation requires an authenticated principal with Kubernetes RBAC permission to create PersistentVolume objects referencing the EFS CSI driver. The attacker crafts a PersistentVolume whose mounttargetipmap value contains a comma-delimited payload with additional mount options such as alternative source paths or option overrides. When the driver mounts the volume on a node, the injected options alter the resulting mount, which can expose unintended file system paths to the pod or interfere with node-level mount state. No code is required beyond submitting a crafted PersistentVolume manifest; see the GitHub Security Advisory for payload specifics.

Detection Methods for CVE-2026-103505

Indicators of Compromise

• PersistentVolume or StorageClass objects whose mounttargetipmapvolumeAttribute contains unexpected commas, mount flags, or path separators beyond the documented AZ-to-IP mapping format.
• CSI driver pod logs showing mount invocations with unusual option strings or non-EFS source arguments.
• Node-level /proc/mounts entries for EFS targets that include options not configured by cluster administrators.

Detection Strategies

• Audit Kubernetes API server logs for create and update operations on PersistentVolume resources that reference efs.csi.aws.com and inspect volumeAttributes payloads.
• Deploy an admission controller or OPA/Gatekeeper policy that validates mounttargetipmap against a strict regex matching only az:ip pairs.
• Compare rendered mount commands on worker nodes with the expected format defined by the driver documentation.

Monitoring Recommendations

• Alert on any PersistentVolume creation by non-administrative service accounts or namespaces that should not provision storage.
• Monitor the efs-csi-node DaemonSet for unexpected process executions or elevated mount activity.
• Centralize node mount and umount syscall telemetry and review for options outside the sanctioned EFS configuration baseline.

How to Mitigate CVE-2026-103505

Immediate Actions Required

• Upgrade the AWS EFS CSI Driver to version v3.5.0 or later across all clusters, as directed by the GitHub release notes.
• Review existing PersistentVolume and StorageClass definitions for malformed mounttargetipmap values and remove or recreate suspect objects.
• Restrict RBAC permissions for PersistentVolume creation to trusted cluster administrators and automation accounts only.

Patch Information

AWS and the Kubernetes SIG-maintained project released a fix in aws-efs-csi-driverv3.5.0. The patched release enforces strict validation of the mounttargetipmap field and rejects values containing argument delimiters. Operators should follow the guidance in AWS Security Bulletin 2026-120 and redeploy the driver via Helm or the EKS add-on channel.

Workarounds

• Apply an admission policy that validates mounttargetipmap against the pattern ^([a-z0-9-]+:\d{1,3}(\.\d{1,3}){3})(;[a-z0-9-]+:\d{1,3}(\.\d{1,3}){3})*$ and rejects commas within the field until patching is possible.
• Limit the subjects allowed to create PersistentVolume objects or EFS-backed StorageClass resources using Kubernetes RBAC.
• Where feasible, provision EFS volumes exclusively through cluster-administrator-managed static PersistentVolume definitions rather than user-submitted dynamic provisioning requests.

# Example: upgrade the AWS EFS CSI Driver via Helm to the fixed release
helm repo update
helm upgrade --install aws-efs-csi-driver \
  aws-efs-csi-driver/aws-efs-csi-driver \
  --namespace kube-system \
  --version 3.5.0

# Verify the deployed driver image tag
kubectl -n kube-system get daemonset efs-csi-node \
  -o jsonpath='{.spec.template.spec.containers[*].image}'