AWS EFS CSI Driver 3.5.0 Fixes Mount Option Injection
Tech GuruQuick Answer
AWS published 2026-120-AWS for Amazon EFS CSI Driver for Kubernetes. AWS corrected a mount-option injection issue in the dynamic-provisioning path: an actor allowed to create a PersistentVolume could place crafted content in the mounttargetipmap field. AWS recommends restricting PersistentVolume and StorageClass creation to cluster administrators until version 3.5.0 is deployed.
Confirm Scope And Apply The Supported Fix
What to do now: Identify Amazon EFS CSI Driver for Kubernetes, match the exact affected release and exposed workflow, apply the supported fix, validate operations, and preserve change and investigation evidence.
Last verified: 2026-10-03 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Amazon EFS CSI Driver for Kubernetes |
|---|---|
| Advisory | 2026-120-AWS |
| CVE | CVE-2026-103505 |
| Authoritative release date | 2026-10-01 15:30:00 UTC (AWS bulletin publication time) |
| Authority revision date | 2026-10-01 15:30:00 UTC (latest authority revision verified for this run) |
| Affected versions | Amazon EFS CSI Driver versions 3.1.0 through 3.4.2. |
| Fixed version | Amazon EFS CSI Driver 3.5.0 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
AWS corrected a mount-option injection issue in the dynamic-provisioning path: an actor allowed to create a PersistentVolume could place crafted content in the mounttargetipmap field.
What To Validate Now
- Inventory. Locate Amazon EFS CSI Driver for Kubernetes deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Inventory clusters running Amazon EFS CSI Driver 3.1.0 through 3.4.2 and identify principals allowed to create PersistentVolumes or StorageClasses. Do not treat EFS use alone as proof of exposure.
- Remediate. Upgrade the Amazon EFS CSI Driver to version 3.5.0 through the supported deployment channel. Until upgraded, use Kubernetes RBAC to restrict PersistentVolume and StorageClass creation to cluster administrators.
- Validate. Confirm the deployed controller and node images report version 3.5.0, test representative EFS provisioning and mounts, review recent PersistentVolume specifications for unexpected mounttargetipmap content, and retain cluster audit evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Test storage provisioning, node rollout, workload remounts, availability, and rollback in a representative cluster. Preserve Kubernetes audit logs before rotating workloads or deleting suspicious objects.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
