Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M

CVE-2026-32241Flannel vulnerable to cross-node remote code execution via extension backend BackendData injection

High 7.5

In plain English

A high-severity command injection in flannel from flannel-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)2.8%top 13.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execution on every flannel node in the cluster. The Extension backend's SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via stdin (from the `flannel.alpha.coreos.com/backend-data` Node annotation). The content of this annotation is unmarshalled and piped directly to a shell command without checks. Kubernetes clusters using Flannel with the Extension backend are affected by this vulnerability. Other backends such as vxlan and wireguard are unaffected. The vulnerability is fixed in version v0.28.2. As a workaround, use Flannel with another backend such as vxlan or wireguard.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/flannel-io/flannel	0.28.2	GHSA-vchx-5pr6-ffx2
Go	github.com/flannel-io/flannel	0.28.2	GO-2026-4894

Affected products (as reported)

Vendor	Product	Versions
flannel-io	flannel	< 0.28.2

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2 x_refsource_CONFIRM
https://github.com/flannel-io/flannel/releases/tag/v0.28.2 x_refsource_MISC