Back Cybersecuritynews

Kubernetes CSI Driver for NFS Vulnerability Lets Attackers Delete or Modify NFS Server Directories

Cybersecuritynews •Guru Baran • March 17, 2026

A path traversal vulnerability has been identified in the Kubernetes Container Storage Interface (CSI) Driver for NFS, potentially allowing attackers to delete or modify unintended directories on NFS servers. The flaw stems from insufficient validation of the subDir parameter in volume identifiers, exposing clusters that permit users to create PersistentVolumes referencing the NFS CSI driver. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kubernetes NFS CSI Driver Vulnerability Allows Unauthorized Directory Access A path traversal vulnerability has been discovered in the Kubernetes Container Storage Interface (CSI) Driver for NFS, allowing attackers to delete or modify unintended directories on NFS servers. This flaw, tracked as CVE-2026-3864, is due to insufficient validation of the subDir parameter in volume identifiers. It affects all versions of the NFS CSI driver and poses a medium-severity risk with a CVSS v3.1 score of 6.5. The vulnerability impacts clusters that allow users to create PersistentVolumes referencing the NFS CSI driver. Organizations using this driver are at risk of unauthorized directory modifications and deletions. The vulnerability was disclosed by SentinelOne researcher Shaul Ben Hai. No active exploitation has been reported yet, but the potential for abuse remains significant. Users are advised to monitor for updates and apply patches as they become available. 2 sources 55

Kubernetes CSI Driver for NFS Vulnerability Lets Attackers Delete or Modify NFS Server Directories

The full story

Extracted Entities

Attack Types (1)

Platforms (2)