oss-security - [kubernetes] CVE-2026-3865: CSI Driver for SMB path traversal via subDir may delete unintended directories on the SMB server

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAH02z484+in9inWQ0KEcDoij9KK5=Q5Q1gcJx0TP7GDLn9F4Bw@mail.gmail.com>
Date: Fri, 10 Apr 2026 19:05:17 -0400
From: Vinayak Goyal <vinayakankugoyal@...il.com>
To: oss-security@...ts.openwall.com
Subject: [kubernetes] CVE-2026-3865: CSI Driver for SMB path traversal via
 subDir may delete unintended directories on the SMB server

Hello Kubernetes Community,

A vulnerability was identified in the Kubernetes CSI Driver for SMB where
insufficient validation of the subDir parameter in volume identifiers could
allow path traversal. A malicious user with the ability to create a
PersistentVolume referencing the SMB CSI driver could craft a volumeHandle
containing traversal sequences (for example ../). When the driver performs
cleanup operations during volume deletion, these sequences may cause the
driver to operate on unintended directories on the SMB server.

An attacker exploiting this flaw could cause deletion or modification of
directories outside the intended managed subdirectory within the SMB export.

This issue has been rated Medium (6.5) with
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
<https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H>
and assigned CVE-2026-3865.

Am I vulnerable?

You may be vulnerable if:

   -

   You run the CSI Driver for SMB (smb.csi.k8s.io)
   -

   Your cluster allows users to create PersistentVolumes referencing the
   SMB CSI driver
   -

   Your CSI driver version does not validate traversal sequences in the
   subDir field

Affected Versions

   -

   All versions of the CSI Driver for SMB prior to the v1.20.1 release
   containing the fix for traversal validation are affected.

How do I mitigate this vulnerability?

This issue can be mitigated by:

   -

   Upgrading the CSI Driver for SMB to a patched version
   -

   Restricting PersistentVolume creation privileges to trusted
   administrators
   -

   Reviewing SMB exports to ensure only intended directories are writable
   by the driver

As a best practice, untrusted users should not be granted permission to
create arbitrary PersistentVolumes referencing external storage drivers.

Fixed Versions

   -

   CSI Driver for SMB versions >= v1.20.1

Detection

To determine if your cluster may be affected:

   -

   Inspect PersistentVolumes using the SMB CSI driver and review the
   volumeHandle field.
   -

   Look for traversal sequences such as: `../`
   -

   Review CSI controller logs for unexpected directory operations. e.g.
   “Removing subPath: /tmp/mount-uuid/legitimate/../../../exports/subdir”

If you find evidence that this vulnerability has been exploited, please
contact security@...ernetes.io

Additional Details

See the GitHub issue for more details:
https://github.com/kubernetes/kubernetes/issues/138319

Acknowledgements

This vulnerability was reported by @Shaul Ben Hai, Senior Staff Security
Researcher from SentinelOne.

The issue was fixed by the CSI Driver for SMB maintainers and the
Kubernetes Security Response Committee.

Andy Zhang @andyzhangx

Vinayak Goyal @vinayakankugoyal

Thank You,

Vinayak Goyal on behalf of the Kubernetes Security Response Committee

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.