diff --git a/pkg/service/controller.go b/pkg/service/controller.go
index 270dd072..8b55fa22 100644
--- a/pkg/service/controller.go
+++ b/pkg/service/controller.go
@@ -51,6 +51,13 @@ func (c *ControllerService) CreateVolume(ctx context.Context, req *csi.CreateVol
 			"failed to parse storage class field %s, expected 'true' or 'false' but got %s",
 			ParameterThinProvisioning, req.Parameters[ParameterThinProvisioning])
 	}
+	// Check access mode
+	for _, cap := range req.GetVolumeCapabilities() {
+		if cap.AccessMode.Mode != csi.VolumeCapability_AccessMode_SINGLE_NODE_READER_ONLY &&
+			cap.AccessMode.Mode != csi.VolumeCapability_AccessMode_SINGLE_NODE_WRITER {
+			return nil, fmt.Errorf("unsupported access mode %s, currently only RWO is supported", cap.AccessMode.Mode)
+		}
+	}
 	requiredSize := req.CapacityRange.GetRequiredBytes()
 	// Check if a disk with the same name already exist
 	disks, err := c.ovirtClient.ListDisksByAlias(diskName, ovirtclient.ContextStrategy(ctx))
diff --git a/pkg/service/controller_test.go b/pkg/service/controller_test.go
index a7ea72b6..c172f6a4 100644
--- a/pkg/service/controller_test.go
+++ b/pkg/service/controller_test.go
@@ -33,6 +33,39 @@ func TestVolumeCreation(t *testing.T) {
 	}
 }
 
+func TestCreateRWXVolumeFails(t *testing.T) {
+	helper := getMockHelper(t)
+	controller := service.NewOvirtCSIDriver(helper.GetClient(), "test")
+	testStorageDomain, err := helper.GetClient().GetStorageDomain(helper.GetStorageDomainID())
+	if err != nil {
+		t.Fatalf("failed to get stoarge domain %s", helper.GetStorageDomainID())
+	}
+
+	_, err = controller.CreateVolume(context.Background(), &csi.CreateVolumeRequest{
+		Name: "test",
+		CapacityRange: &csi.CapacityRange{
+			RequiredBytes: 4096,
+			LimitBytes:    4096,
+		},
+		Parameters: map[string]string{
+			"storageClass":      "ovirt-test-domain",
+			"storageDomainName": testStorageDomain.Name(),
+			"thinProvisioning":  "true",
+		},
+		VolumeCapabilities: []*csi.VolumeCapability{
+			{
+				AccessMode: &csi.VolumeCapability_AccessMode{
+					Mode: csi.VolumeCapability_AccessMode_MULTI_NODE_MULTI_WRITER,
+				},
+			},
+		},
+	})
+
+	if err == nil {
+		t.Fatalf("publishing RWX volume which shouldn't be possible")
+	}
+}
+
 func TestDeleteVolume(t *testing.T) {
 	helper := getMockHelper(t)
 	controller := service.NewOvirtCSIDriver(helper.GetClient(), "test")