{"schema":"vulnpedia.research/1","cve":"CVE-2026-103505","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.5.0","tags":["patch","vendor-reference"],"source":"mitre","sourceId":"AMZN","modified":"2026-10-09T16:32:11.554Z","origins":[{"source":"mitre","sourceId":"AMZN","modified":"2026-10-09T16:32:11.554Z","url":"https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.5.0"},{"source":"nvd","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:17:07.940","url":"https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.5.0"},{"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","url":"https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.5.0"}]},{"url":"https://aws.amazon.com/security/security-bulletins/2026-120-aws/","tags":["vendor-advisory","vendor-reference"],"source":"mitre","sourceId":"AMZN","modified":"2026-10-09T16:32:11.554Z","origins":[{"source":"mitre","sourceId":"AMZN","modified":"2026-10-09T16:32:11.554Z","url":"https://aws.amazon.com/security/security-bulletins/2026-120-aws/"},{"source":"nvd","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:17:07.940","url":"https://aws.amazon.com/security/security-bulletins/2026-120-aws/"},{"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","url":"https://aws.amazon.com/security/security-bulletins/2026-120-aws/"}]},{"url":"https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-pv26-6q9q-5773","tags":["third-party-advisory"],"source":"mitre","sourceId":"AMZN","modified":"2026-10-09T16:32:11.554Z","origins":[{"source":"mitre","sourceId":"AMZN","modified":"2026-10-09T16:32:11.554Z","url":"https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-pv26-6q9q-5773"},{"source":"nvd","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:17:07.940","url":"https://github.com/kubernetes-sigs/aws-efs-csi-driver/security/advisories/GHSA-pv26-6q9q-5773"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103505.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103505.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-103505","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-103505"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544868","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544868"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-103505","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-103505"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103505","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103505"}]},{"source":"euvd","sourceId":"EUVD-2026-90883","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90883","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-90883","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90883"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103505.json","productId":"red_hat_openshift_container_platform_4:openshift4/ose-aws-efs-csi-driver-container-rhel8","product":"openshift4/ose-aws-efs-csi-driver-container-rhel8 as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict PersistentVolume creation permissions to trusted users and follow least-privilege RBAC practices. Upgrade the AWS EFS CSI Driver to version 3.5.0 or later when the corresponding Red Hat update is available. Until then, avoid using the affected mounttargetipmap attribute with untrusted input."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/ose-aws-efs-csi-driver-container-rhel8@sha256:33c0b7e2354d05e7c349af22e8c491ee07604e01d8d490cadc5c943661a9e87a?repository_url=registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel8","origins":[{"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103505.json"}]},{"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103505.json","productId":"red_hat_openshift_container_platform_4:openshift4/ose-aws-efs-csi-driver-container-rhel9","product":"openshift4/ose-aws-efs-csi-driver-container-rhel9 as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict PersistentVolume creation permissions to trusted users and follow least-privilege RBAC practices. Upgrade the AWS EFS CSI Driver to version 3.5.0 or later when the corresponding Red Hat update is available. Until then, avoid using the affected mounttargetipmap attribute with untrusted input."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/ose-aws-efs-csi-driver-container-rhel9@sha256:a2b03fce52dce1e5a3894818b0943bef2881aff78977821c6735b70619d92a1a?repository_url=registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-103505","modified":"2026-10-02T14:40:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103505.json"}]}],"vendorCoverage":{"total":2,"shown":2,"omitted":0,"source":"redhat"}}