An authenticated Kubernetes user that has permission to create PersistentVolume objects can exploit a flaw in the Amazon EFS CSI Driver’s volume deletion logic. The driver fails to verify that the access point used to identify the volume belongs to the target EFS filesystem, allowing a crafted volumeHandle that couples an access point from one filesystem with a different target filesystem. This flaw can lead to recursive deletion of directories on an EFS filesystem that the attacker is not otherwise authorized to modify, potentially causing loss of data and service disruption. The weakness is a broken access control (CWE‑283) combined with unauthorized privilege escalation (CWE‑639).

AWS EFS CSI Driver versions earlier than 3.4.1. The vulnerability affects the volume deletion component, so any Kubernetes cluster that has installed a prior release of the driver is impacted.

The CVSS score of 5.1 indicates a moderate severity. Exploitation requires only an authenticated Kubernetes user with PersistentVolume creation privileges, which are explicitly mentioned in the CVE description. The EPSS score of less than 1% suggests a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. The attack vector thus depends on proper authentication and authorization within the Kubernetes environment.