CVE-2026-3864

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3864", "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565", "state": "PUBLISHED", "assignerShortName": "kubernetes", "dateReserved": "2026-03-10T06:18:16.575Z", "datePublished": "2026-03-20T22:21:33.827Z", "dateUpdated": "2026-03-23T14:13:53.553Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CSI Driver for NFS", "vendor": "Kubernetes", "versions": [{"status": "affected", "version": "0", "lessThan": "4.13.1", "versionType": "semver"}, {"status": "unaffected", "version": "4.13.1"}]}], "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Shaul Ben Hai, Senior Staff Security Researcher, SentinelOne"}], "datePublic": "2026-03-17T00:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended directories outside the intended managed path within the NFS export, which may lead to deletion or modification of directories on the NFS server.</div>"}], "value": "A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended directories outside the intended managed path within the NFS export. This may lead to deletion or modification of directories on the NFS server."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22 Path Traversal", "type": "CWE"}]}], "providerMetadata": {"orgId": "a6081bf6-c852-4425-ad4f-a67919267565", "shortName": "kubernetes", "dateUpdated": "2026-03-20T22:21:33.827Z"}, "references": [{"tags": ["mailing-list"], "url": "https://groups.google.com/g/kubernetes-security-announce/c/i4ZKN9VLcUE"}, {"tags": ["issue-tracking"], "url": "https://github.com/kubernetes/kubernetes/issues/137797"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>Upgrade the CSI Driver for NFS to version 4.13.1 or later. As mitigations, restrict PersistentVolume creation privileges to trusted administrators and review NFS exports to ensure only intended directories are writable by the driver.</div>"}], "value": "Upgrade the CSI Driver for NFS to version 4.13.1 or later. As mitigations, restrict PersistentVolume creation privileges to trusted administrators and review NFS exports to ensure only intended directories are writable by the driver."}], "source": {"discovery": "EXTERNAL"}, "title": "CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/17/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-20T23:10:38.486Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T14:13:44.147797Z", "id": "CVE-2026-3864", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T14:13:53.553Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/17/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-20T23:10:38.486Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3864", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T14:13:44.147797Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T14:13:49.898Z"}}], "cna": {"title": "CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Shaul Ben Hai, Senior Staff Security Researcher, SentinelOne"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server"}]}], "affected": [{"vendor": "Kubernetes", "product": "CSI Driver for NFS", "versions": [{"status": "affected", "version": "0", "lessThan": "4.13.1", "versionType": "semver"}, {"status": "unaffected", "version": "4.13.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade the CSI Driver for NFS to version 4.13.1 or later. As mitigations, restrict PersistentVolume creation privileges to trusted administrators and review NFS exports to ensure only intended directories are writable by the driver.", "supportingMedia": [{"type": "text/html", "value": "<div>Upgrade the CSI Driver for NFS to version 4.13.1 or later. As mitigations, restrict PersistentVolume creation privileges to trusted administrators and review NFS exports to ensure only intended directories are writable by the driver.</div>", "base64": false}]}], "datePublic": "2026-03-17T00:00:00.000Z", "references": [{"url": "https://groups.google.com/g/kubernetes-security-announce/c/i4ZKN9VLcUE", "tags": ["mailing-list"]}, {"url": "https://github.com/kubernetes/kubernetes/issues/137797", "tags": ["issue-tracking"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended directories outside the intended managed path within the NFS export. This may lead to deletion or modification of directories on the NFS server.", "supportingMedia": [{"type": "text/html", "value": "<div>A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended directories outside the intended managed path within the NFS export, which may lead to deletion or modification of directories on the NFS server.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Path Traversal"}]}], "providerMetadata": {"orgId": "a6081bf6-c852-4425-ad4f-a67919267565", "shortName": "kubernetes", "dateUpdated": "2026-03-20T22:21:33.827Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3864", "state": "PUBLISHED", "dateUpdated": "2026-03-23T14:13:53.553Z", "dateReserved": "2026-03-10T06:18:16.575Z", "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565", "datePublished": "2026-03-20T22:21:33.827Z", "assignerShortName": "kubernetes"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CSI Driver for NFS", "vendor": "Kubernetes", "versions": [{"lessThan": "4.13.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "4.13.1"}]}], "source": "jordan@liggitt.net"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended directories outside the intended managed path within the NFS export. This may lead to deletion or modification of directories on the NFS server."}, {"lang": "es", "value": "Se descubri\u00f3 una vulnerabilidad en el controlador CSI de Kubernetes para NFS donde el par\u00e1metro subDir en los identificadores de volumen no se validaba suficientemente. Atacantes con la capacidad de crear PersistentVolumes que hacen referencia al controlador CSI de NFS podr\u00edan crear identificadores de volumen que contienen secuencias de salto de ruta (../). Durante las operaciones de eliminaci\u00f3n o limpieza de volumen, el controlador podr\u00eda operar en directorios no deseados fuera de la ruta gestionada prevista dentro de la exportaci\u00f3n NFS. Esto podr\u00eda llevar a la eliminaci\u00f3n o modificaci\u00f3n de directorios en el servidor NFS."}], "id": "CVE-2026-3864", "lastModified": "2026-06-17T10:44:21.283", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "jordan@liggitt.net", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3864", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T14:13:44.147797Z", "version": "2.0.3"}}]}, "published": "2026-03-20T23:16:48.303", "references": [{"source": "jordan@liggitt.net", "url": "https://github.com/kubernetes/kubernetes/issues/137797"}, {"source": "jordan@liggitt.net", "url": "https://groups.google.com/g/kubernetes-security-announce/c/i4ZKN9VLcUE"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/03/17/1"}], "sourceIdentifier": "jordan@liggitt.net", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "jordan@liggitt.net", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.13.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "4.13.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "CSI Driver for NFS", "source": "cna", "vendor": "Kubernetes"}, "product": "csi_driver_for_nfs", "vendor": "kubernetes"}], "analysis": {"en": {"generated_at": "2026-03-20T23:23:34.009760+00:00", "value": {"mitigation_remediation": ["Upgrade the CSI Driver for NFS to version 4.13.1 or later.", "Restrict PersistentVolume creation privileges to trusted administrators.", "Review NFS exports to ensure only intended directories are writable by the driver.", "Audit cluster resources to detect unauthorized PersistentVolumes and validate subDir values."], "summary": {"action": "Patch", "impact": "Data Loss"}, "threat_synthesis": {"affected_systems": "The affected product is Kubernetes CSI Driver for NFS. Versions prior to v4.13.1 are vulnerable, as the advisory recommends upgrading to 4.13.1 or newer. The driver is used in Kubernetes clusters to provide block storage through NFS exports; any cluster that employs the unpatched driver and permits users or workloads to create arbitrary PersistentVolumes is at risk.", "description_and_impact": "The vulnerability arises from insufficient validation of the subDir parameter within Kubernetes CSI Driver for NFS, enabling attackers to craft path traversal sequences such as \"../\" in volume identifiers. When the driver performs deletions or cleanup operations on those volumes, it resolves the path traversal and operates on directories outside the intended NFS export. This allows unintended deletion or modification of directories on the NFS server, compromising data integrity and availability.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available. Exploitation requires permissions to create PersistentVolumes, typically cluster-admin or equivalent privileges. During a delete or orphan cleanup operation, the driver will resolve the path traversal before executing filesystem commands, enabling an attacker to permanently remove or alter data stored on the NFS server."}}}}, "created": "2026-03-23T09:52:28.728549+00:00", "updated": "2026-03-25T14:34:22.386934+00:00", "vendors": ["kubernetes", "kubernetes$PRODUCT$csi_driver_for_nfs"]}