CVE-2026-85781

The record

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem. To remediate this issue, users should upgrade to version v3.4.1.

Affected packages

Related vulnerabilities

• CVE-2026-87913 A missing S3 bucket ownership verification in the AWS Security Agent MCP server before… CWE-283
• CVE-2026-87912 A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon… CWE-283
• CVE-2026-9745 IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed… CWE-283
• CVE-2026-54467 On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox… CWE-283
• CVE-2026-15599 Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research… CWE-283
• CVE-2026-44707 Chatwoot is a customer engagement suite. CWE-283
• CVE-2026-44562 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… CWE-283
• CVE-2026-40337 The Sentry kernel is a high security level micro-kernel implementation made for high… CWE-283