Gbhackers Kubernetes NFS CSI Driver Vulnerability Allows Unauthorized Directory Access
Article Content
- •CVE-2026-3864 allows unauthorized modifications to NFS server directories.
- •The vulnerability affects all versions of the Kubernetes NFS CSI driver.
- •No active exploitation has been reported, but the risk remains significant.
A path traversal vulnerability has been discovered in the Kubernetes Container Storage Interface (CSI) Driver for NFS, allowing attackers to delete or modify unintended directories on NFS servers. This flaw, tracked as CVE-2026-3864, is due to insufficient validation of the subDir parameter in volume identifiers. It affects all versions of the NFS CSI driver and poses a medium-severity risk with a CVSS v3.1 score of 6.5. The vulnerability impacts clusters that allow users to create PersistentVolumes referencing the NFS CSI driver. Organizations using this driver are at risk of unauthorized directory modifications and deletions. The vulnerability was disclosed by SentinelOne researcher Shaul Ben Hai. No active exploitation has been reported yet, but the potential for abuse remains significant. Users are advised to monitor for updates and apply patches as they become available.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2026-3864 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…