Database/Container, Kubernetes & orchestration
CSI Driver NFS: Path traversal via `subDir` lets a tenant delete unintended directories on the shared NFS server
CVE-2026-3864Container, Kubernetes & orchestrationcurated
Impact
Path traversal via subDir lets a tenant delete unintended directories on the shared NFS server; cross-tenant data destruction
Who can reach it
Cluster user able to create a PV/PVC with a crafted subDir
What to do
DaemonSet/controller rollout; add admission validation on subDir. High priority for neoclouds sharing one NFS backend across tenants
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.