Mount Here, Read There: Twin Path Traversal CVEs in Kubernetes Storage

The vulnerabilities described in CVE-2026-3859 (Kubernetes CSI Driver for NFS) and CVE-2026-3865 (Kubernetes CSI Driver for SMB) highlight critical security issues related to multi-tenant storage configurations within Kubernetes clusters. These vulnerabilities stem from improper handling of volumeHandle parameters, which can lead to path traversal attacks allowing attackers to access or modify files outside their intended directory boundaries.

Key Points

1. Vulnerability Overview:

   • Both NFS and SMB CSI drivers in Kubernetes failed to properly validate the subDir component within the volumeHandle, leading to potential path traversal.
   • The vulnerability allows an attacker with permission to create PersistentVolumes (persistentvolumes:create) to craft malicious volume handles that traverse into other tenants' directories.

2. Exploitation Details:

   • An attacker can inject a crafted PersistentVolume definition containing a malformed volumeHandle.
   • This malformed handle includes path traversal components (e.g., ../..), allowing the attacker to access files in sibling tenant directories.
   • The attack vector is particularly dangerous because it leverages Kubernetes API permissions rather than requiring direct node-level or network-level

Read the full article at SentinelOne Labs

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.