openwall.com
http://www.openwall.com/lists/oss-security/2026/03/17/1 CVE-2026-3864
MEDIUM
CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server
Record summary
CVE-2026-3864 has a selected CVSS score of 6.5 (medium).
Description
A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended directories outside the intended managed path within the NFS export. This may lead to deletion or modification of directories on the NFS server.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 23, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
CSI Driver for NFSBrowse Kubernetes / CSI Driver for NFSDefault status: unaffected | CVE List | Before 4.13.1 | affected |
| 4.13.1 | unaffected | ||
github.com/kubernetes-csi/csi-driver-nfsBrowse Go / github.com/kubernetes-csi/csi-driver-nfs | GitHub Advisory | Before 0.0.0-20260210055231-316af2d86b91 · Fixed in 0.0.0-20260210055231-316af2d86b91 | affected |
References
6github.com
https://github.com/kubernetes-csi/csi-driver-nfs github.com
https://github.com/kubernetes-csi/csi-driver-nfs/commit/316af2d86b913a595542dc17e8599cf81afd938f github.comissue tracking
https://github.com/kubernetes/kubernetes/issues/137797 groups.google.commailing list
https://groups.google.com/g/kubernetes-security-announce/c/i4ZKN9VLcUE nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-3864