In plain language
What this advisory means
A flaw in the Amazon EFS CSI Driver, used to connect Kubernetes workloads to Amazon EFS file systems, allowed certain authenticated users to delete files from EFS file systems they should not access. This happened only if a specific optional setting was enabled. The underlying Amazon EFS permissions remained secure.
Technical explanation
How the issue affects the environment
The vulnerability (CVE-2026-85781) in the Amazon EFS CSI Driver occurs in its volume-deletion logic when the non-default option --delete-access-point-root-dir=true is set. The controller failed to verify that the EFS access point ID in a PersistentVolume's volume handle actually belonged to the specified file system. An attacker with Kubernetes PersistentVolume creation rights could craft a volume handle referencing an unauthorized EFS access point, causing recursive deletion of directories on that file system. Amazon EFS access controls themselves are unaffected; only the CSI driver's validation was faulty.
Operational impact
Why teams should care
This issue could lead to unauthorized deletion of directories on Amazon EFS file systems by malicious Kubernetes users who can create PersistentVolumes. Such unintended deletions risk data loss and operational disruptions for organizations using affected configurations.
Immediate action
Upgrade to Amazon EFS CSI Driver version v3.4.1 or later to fix the vulnerability. If immediate upgrade is not possible, disable the --delete-access-point-root-dir option, restrict PersistentVolume creation to trusted administrators using RBAC, limit the controller's IAM role to only necessary file systems, and attach explicit EFS resource policies to file systems.
Affected and fixed releases
Temporary risk reduction
Disabling the --delete-access-point-root-dir flag prevents this vulnerability from being exploitable. Additionally, restricting PersistentVolume creation permissions and scoping IAM roles can mitigate risk until a patch is applied.
Evidence and validation checklist
- AWS Security Bulletins official advisory (https://aws.amazon.com/security/security-bulletins/rss/2026-099-aws/)
- CVE-2026-85781 entry with description and resolution
- Release notes for EFS CSI Driver v3.4.1 addressing the issue.
- AWS recommendations on mitigation and upgrades.
Authoritative reference
AWS Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.