Is CVE-2026-85781 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85781 being exploited in the wild.

How severe is CVE-2026-85781?

High severity, with a CVSS score of 8.7, published 4 September 2026.

Is there a fix for CVE-2026-85781?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85781 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85781?

Check whether you run Amazon AWS or Amazon EFS CSI Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85781: Amazon EFS CSI Driver insufficient access point ownership validation

CVE-2026-85781 · Severity: high · CVSS 8.7 · Published 2026-09-04

The Amazon EFS CSI Driver is a Kubernetes storage plugin that enables containerized applications to use Amazon EFS file systems. A vulnerability in its volume-deletion logic allows authenticated Kubernetes users with permission to create volumes to exploit a non-default configuration and cause the driver to recursively delete directories from EFS file systems they are not authorized to access, potentially resulting in data loss.

Technologies: Amazon AWS, Amazon EFS CSI Driver. Vendors: Amazon.

Quick answers

Is CVE-2026-85781 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85781 being exploited in the wild.
How severe is CVE-2026-85781?: High severity, with a CVSS score of 8.7, published 4 September 2026.
Which products and versions are affected?: Amazon EFS CSI Driver <=3.4.0.
Is there a fix for CVE-2026-85781?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85781 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85781?: Check whether you run Amazon AWS or Amazon EFS CSI Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-85781 is an insufficient validation vulnerability in the Amazon EFS CSI Driver's volume-deletion controller logic. When the non-default --delete-access-point-root-dir=true flag is enabled, the controller fails to verify that the EFS access point referenced in a PersistentVolume's volume handle actually belongs to the file system also referenced in that same volume handle. An authenticated Kubernetes user with create/delete PersistentVolume permissions can craft a malicious volume handle containing a valid access point from a different EFS file system, causing the controller to recursively delete directories from that unauthorized file system during volume deletion. The vulnerability requires specific configuration (the non-default flag must be set) and Kubernetes API access, but does not affect the underlying Amazon EFS access control mechanisms. Patches are expected in versions after 3.4.0.

Affected products

Amazon EFS CSI Driver <=3.4.0

Timeline

2026-09-09: disclosed
2026-09-04: advisory: AWS Security Bulletin 2026-099-AWS published

References

https://aws.amazon.com/security/security-bulletins/rss/2026-099-aws/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.