Is CVE-2026-6437 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6437 being exploited in the wild.

How severe is CVE-2026-6437?

High severity, with a CVSS score of 6.5, published 17 April 2026.

Which products and versions are affected?

Amazon EFS CSI Driver <= v3.0.0; github.com/kubernetes-sigs/aws-efs-csi-driver (Go) < 1.7.8-0.20260416142831-51806c22c575, SEMVER:introduced=0,fixed=1.7.8-0.20260416142831-51806c22c575.

Is there a fix for CVE-2026-6437?

Yes. github.com/kubernetes-sigs/aws-efs-csi-driver (Go): upgrade to 1.7.8-0.20260416142831-51806c22c575 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6437 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6437?

Check whether you run Amazon AWS, Amazon EFS CSI Driver or github.com/kubernetes-sigs/aws-efs-csi-driver (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6437: AWS EFS CSI Driver argument injection in volume handling

Q: Is there a fix for CVE-2026-6437?

Yes. github.com/kubernetes-sigs/aws-efs-csi-driver (Go): upgrade to 1.7.8-0.20260416142831-51806c22c575 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-6437 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-6437?

Check whether you run Amazon AWS, Amazon EFS CSI Driver or github.com/kubernetes-sigs/aws-efs-csi-driver (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6437 · Severity: high · CVSS 6.5 · Published 2026-04-17

The AWS EFS CSI Driver allows Kubernetes clusters to manage and use Amazon Elastic File System storage. A security flaw in this driver allows users with specific administrative permissions to inject unauthorized settings when mounting storage volumes. This could lead to unauthorized data access or modification within the file system, potentially compromising sensitive business data stored in the cloud.

Technologies: Amazon AWS, Amazon EFS CSI Driver. Vendors: Amazon, Go.

Quick answers

Is CVE-2026-6437 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6437 being exploited in the wild.
How severe is CVE-2026-6437?: High severity, with a CVSS score of 6.5, published 17 April 2026.
Which products and versions are affected?: Amazon EFS CSI Driver <= v3.0.0; github.com/kubernetes-sigs/aws-efs-csi-driver (Go) < 1.7.8-0.20260416142831-51806c22c575, SEMVER:introduced=0,fixed=1.7.8-0.20260416142831-51806c22c575.
Is there a fix for CVE-2026-6437?: Yes. github.com/kubernetes-sigs/aws-efs-csi-driver (Go): upgrade to 1.7.8-0.20260416142831-51806c22c575 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6437 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6437?: Check whether you run Amazon AWS, Amazon EFS CSI Driver or github.com/kubernetes-sigs/aws-efs-csi-driver (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/kubernetes-sigs/aws-efs-csi-driver (Go): upgrade to 1.7.8-0.20260416142831-51806c22c575 or later
```
go get github.com/kubernetes-sigs/aws-efs-csi-driver@v1.7.8-0.20260416142831-51806c22c575
```

Technical details

An argument injection vulnerability (CWE-88) exists in the AWS EFS CSI Driver due to improper neutralization of argument delimiters in the volume handling component. Specifically, the 'volumeHandle' (Access Point ID) and 'mounttargetip' fields are not properly sanitized before being passed to the system mount command. An attacker with Kubernetes 'PersistentVolume' creation privileges can use comma-separated values to inject arbitrary mount options. This allows the attacker to apply unauthorized filesystem settings, potentially leading to a breach of confidentiality or integrity on the mounted EFS volumes. The issue is fixed in version v3.0.1.

Affected products

AWS EFS CSI Driver < v3.0.1

Identifiers

CVE-2026-6437
GHSA-mph4-q2vm-w2pw

Timeline

2026-04-16: patched: Version v3.0.1 released
2026-04-17: disclosed: Initial advisory publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.