6.5Medium

CVE-2026-3864CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server

Kubernetes CSI Driver for NFS Published: 2026-03-21 01:21 (7 months ago)

Description

A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended directories outside the intended managed path within the NFS export. This may lead to deletion or modification of directories on the NFS server.

Weakness (CWE): CWE-22

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Kubernetes	CSI Driver for NFS	< 4.13.1, fixed 4.13.1

References and patches

https://groups.google.com/g/kubernetes-security-announce/c/i4ZKN9VLcUE mailing-list
https://github.com/kubernetes/kubernetes/issues/137797 issue-tracking
http://www.openwall.com/lists/oss-security/2026/03/17/1

CVSS score

6.5Medium

Source: kubernetes · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

All scores (2)

cna	CVSS 3.1	6.5Medium
jordan@liggitt.net	CVSS 3.1	6.5Medium

EPSS (chance of exploitation in 30 days)

0.75%

higher than 55% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2026-03-10
Published2026-03-21 01:21
Reached IP-DB2026-10-24 23:49
Last updated2026-06-17 13:44

Assigned by (CNA): kubernetes
NVD status: Awaiting Analysis

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Kubernetes

2.7Low

CVE-2026-116472 6 days ago

ingress-nginx mirror-target self-DOS

Kubernetes ingress-nginx; SUSE Rancher Prime RKE2 ingress-nginx

A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected…

5.9Medium

CVE-2026-2270 16 days ago

StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation

Kubernetes Kubernetes

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full c…

5.8Medium

CVE-2026-76654 16 days ago

Subpath symlinking on Windows nodes permits NTLM coercion

Kubernetes Kubernetes

An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves…

6.5Medium

CVE-2026-19444 1 month ago

Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes

Kubernetes Kubernetes

A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the network, and unpacks it on…

2.7Low

CVE-2026-15687 3 months ago

Path traversal via non-tar copyDirectoryFromPod

Kubernetes kubernetes-client/java

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.

8.8High

CVE-2026-4342 7 months ago

ingress-nginx comment-based nginx configuration injection

Kubernetes ingress-nginx

A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets acc…

1.5%EPSS