{"answers":{"affected":"3 open source packages ship an affected version, including github.com/kubernetes-csi/csi-driver-nfs.","exploited":"There is no known exploitation of CVE-2026-3864 in the wild and no public exploit code.","fix":"Upgrade github.com/kubernetes-csi/csi-driver-nfs to 0.0.0-20260210055231-316af2d86b91 or later.","what":"CVE-2026-3864 is a medium-severity path traversal vulnerability in Kubernetes CSI Driver for NFS, published on 20 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-3864 and fix it if it is affected.\n\nWhat it is: CVE-2026-3864 is a medium-severity path traversal vulnerability in Kubernetes CSI Driver for NFS, published on 20 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-3864 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/kubernetes-csi/csi-driver-nfs (Go): affected all versions; fixed in 0.0.0-20260210055231-316af2d86b91\n- github.com/kubernetes-csi/csi-driver-nfs (Go): affected all versions; fixed in 0.0.0-20260210055231-316af2d86b91\n- github.com/kubernetes-csi/csi-driver-nfs (Go): affected all versions; fixed in 0.0.0-20260210055231-316af2d86b91\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-3864/ (Markdown: https://insights.sbomify.com/CVE-2026-3864/index.md)","id":"CVE-2026-3864","markdown":"https://insights.sbomify.com/CVE-2026-3864/index.md","name":"CVE-2026-3864","record":{"aliases":["GHSA-2mjq-54qg-7w6j","GO-2026-4816"],"analysis":{"component_type":"container_or_infrastructure","fix_type":"patch","impacts":["data_modify","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Kubernetes NFS CSI Driver","requires_auth":"high_privilege","summary":"Attackers can delete or modify unintended directories on the NFS server by crafting malicious volume identifiers with path traversal sequences.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"kubernetes","cpe":[],"cvss":{"score":6.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended directories outside the intended managed path within the NFS export. This may lead to deletion or modification of directories on the NFS server.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server","id":"CVE-2026-3864","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":3,"n_references":2,"next":{"headline":"Information disclosure in EDR-8010 Series","id":"CVE-2026-3867"},"packages":[{"ecosystem":"Go","fixed":["0.0.0-20260210055231-316af2d86b91"],"introduced":["0"],"last_affected":[],"package":"github.com/kubernetes-csi/csi-driver-nfs","purl":null,"source":"GHSA-2mjq-54qg-7w6j"},{"ecosystem":"Go","fixed":["0.0.0-20260210055231-316af2d86b91"],"introduced":["0"],"last_affected":[],"package":"github.com/kubernetes-csi/csi-driver-nfs","purl":"pkg:golang/github.com/kubernetes-csi/csi-driver-nfs","source":"GHSA-2mjq-54qg-7w6j"},{"ecosystem":"Go","fixed":["0.0.0-20260210055231-316af2d86b91"],"introduced":["0"],"last_affected":[],"package":"github.com/kubernetes-csi/csi-driver-nfs","purl":"pkg:golang/github.com/kubernetes-csi/csi-driver-nfs","source":"GO-2026-4816"}],"prev":{"headline":"Cross-Site Scripting Vulnerability in SiteMinder Administrative UI","id":"CVE-2026-3862"},"products":["CSI Driver for NFS"],"published":"2026-03-20","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-03-23","vendors":["Kubernetes"]},"summary":"Attackers can delete or modify unintended directories on the NFS server by crafting malicious volume identifiers with path traversal sequences.","url":"https://insights.sbomify.com/CVE-2026-3864/"}