Bug 2458520 (CVE-2026-3865)

Summary: CVE-2026-3865 csi-driver-smb: Kubernetes CSI Driver for SMB: Path Traversal vulnerability allows unauthorized file operations via insufficient subDir validation.
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Kubernetes CSI Driver for SMB. This vulnerability allows an attacker, with the ability to create PersistentVolumes, to craft volume identifiers containing path traversal sequences. This insufficient validation of the `subDir` parameter can lead to the driver operating on unintended directories during volume deletion or cleanup, potentially resulting in unauthorized modification or deletion of files outside the intended managed path.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-14 22:59:00 UTC
A vulnerability was discovered in the Kubernetes CSI Driver for SMB where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the SMB CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended directories outside the intended managed path within the SMB export.

https://github.com/kubernetes-csi/csi-driver-smb/pull/1020