CVE-2026-85781High· 8.7▾ TwilightUnverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.4%
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem.
To remediate this issue, users should upgrade to version v3.4.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-37236Critical· 9.8grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control
CVE-2026-115424Medium· 5.5oc: oc: Symlink/hardlink target validation bypass in oc image extract allows file write outside destination (CVE-2026-115424)
CVE-2026-88753High· 7.5A Regular-Expression Denial of Service (ReDoS) in the Markdown2
CVE-2025-4673Medium· 6.8net/http: Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673)
CVE-2026-104795High· 8.8The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting
CVE-2026-92817High· 8.8The Ignition Perspective module does not properly validate session privileges when determining Designer-level access