The vulnerability is caused by improper neutralization of argument delimiters in the AWS EFS CSI Driver’s volume handling component before version v3.0.1. A remote authenticated user who has permission to create PersistentVolume objects can inject arbitrary mount options by including commas. Those injected options alter the parameters used when an EFS file system is mounted inside a Kubernetes cluster. The potential impact depends on the supplied options; attackers could influence access controls, performance, or other mount behaviors. The advisory does not provide explicit examples of the attack impact, so the precise consequences are inferred from typical mount option semantics.

Affected products are the AWS EFS CSI Driver from Amazon, specifically all releases before version v3.0.1. Any Kubernetes cluster that uses these earlier driver versions is vulnerable unless the administrator applies the available patch.

The CVSS score for this issue is 6.9, indicating a moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV, suggesting it may not yet be actively exploited. The likely attack vector is remote authenticated access via PersistentVolume creation rights. The attack requires the attacker to possess PV creation privileges and therefore is limited to environments where access controls are misconfigured or overly permissive. If these conditions are met, the attacker could deploy pods that mount EFS volumes with malicious options.