Amazon EFS CSI Driver Vulnerability Allows Unauthorized Directory Deletion

Amazon EFS CSI Driver versions ≤3.4.0 contain CVE-2026-85781, a critical flaw in volume-deletion logic. When configured with --delete-access-point-root-dir=true, authenticated Kubernetes users can craft malicious volume handles to recursively delete directories they shouldn't access. User action required: upgrade immediately if using the non-default option. Amazon EFS access controls themselves remain secure.