Two storage drivers maintained by the upstream Kubernetes project shipped a path traversal bug that lets one tenant in a shared cluster reach straight into another tenant's files. SentinelOne researcher Shaul Ben Hai published the analysis after coordinated disclosure through the Kubernetes Security Response Committee, which assigned CVE-2026-3864 to the NFS driver and CVE-2026-3865 to the SMB driver.
What is affected
The vulnerable components are csi-driver-nfs and csi-driver-smb, both maintained by the kubernetes-csi organization. Fixes landed in csi-driver-nfs v4.13.1 and csi-driver-smb v1.20.1. The flaws were reported in January 2026 and held until the maintainers had patches out.
The exposure depends on how a cluster is built. In a default deployment, an attacker can read, modify and delete files belonging to other tenants that share the same network file share. In clusters where the storage controller runs with broader host directory mounts, a common pattern for log collection and operational tooling, the same trick allows arbitrary directory deletion on the Kubernetes worker node itself. Remove paths such as /var/lib/kubelet, /etc/kubernetes or /etc/cni and the node is finished.
How the attack works
Kubernetes does not handle storage itself. It hands the job to a driver through the Container Storage Interface, a contract that deliberately says almost nothing about validating input and leaves isolation entirely to each driver. When a cluster creates a PersistentVolume, that object carries a text field called volumeHandle. Kubernetes stores that string without parsing it. Only the driver interprets it.
Both drivers pack several values into that one string, separated by delimiters, and one of those values is the subdirectory the volume should be mounted from. In the shared export multi tenancy model that both projects document, that subdirectory is the entire security boundary: team A gets one directory, team B gets another, and both sit on the same underlying file share.
The drivers built the final path with the Go standard library function filepath.Join, on the assumption that it prevents directory traversal. It does not. As Ben Hai puts it, the function is a normalizer, not a boundary. It tidies up path segments into a canonical form and has no idea whether the result landed somewhere the caller never intended. Feed it a crafted subdirectory value and the mount escapes into a sibling tenant's data.
Why the threat model does not hold
The documented assumption is that only cluster administrators can create a PersistentVolume, because it is a cluster scoped object. In real clusters that permission is spread far wider. Continuous integration pipelines, GitOps controllers such as ArgoCD, Helm automation and operator service accounts routinely hold it so they can provision storage for applications. Compromise any one of those service accounts and the attack becomes available, which is what turns an interesting parsing bug into a practical one.
What you should do
Upgrade both drivers to the fixed releases. Then audit exactly which service accounts and roles hold the permission to create PersistentVolume objects, and strip it from anything that does not genuinely need cluster scoped provisioning. Where you can, stop sharing a single NFS or SMB export across tenants by subdirectory, and give each tenant its own export so the boundary is enforced by the storage system rather than by string handling in a driver. Finally, review host directory mounts on the storage controller pods, since those are what escalate this from cross tenant file access to node destruction.
The pattern here is the recurring one in cluster infrastructure: the dangerous flaws are rarely in the workloads, they are in the plumbing everyone assumes is validated. It sits alongside the run of critical infrastructure flaws under active attack we covered earlier this month, though there is no public evidence of exploitation of these two in the wild.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.