CVE-2026-32241
Command Injection in Flannel Extension Backend Enables Root Execution
Publication date: 2026-03-27
Last updated on: 2026-04-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| flannel-io | flannel | to 0.28.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-32241 is a command injection vulnerability in the Flannel Kubernetes networking project's experimental Extension backend in versions prior to 0.28.2.
The Extension backend allows users to prototype new backend types by executing shell commands stored in Kubernetes Node annotations.
The vulnerability occurs because the SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via the 'flannel.alpha.coreos.com/backend-data' Node annotation, which is unmarshalled and piped directly to a shell command without validation or sanitization.
An attacker who can modify Kubernetes Node annotations can exploit this to execute arbitrary commands with root privileges on every Flannel node in the cluster.
Other Flannel backends such as vxlan and wireguard are not affected by this vulnerability.
How can this vulnerability impact me? :
This vulnerability can have a severe impact because it allows an attacker with the ability to modify Kubernetes Node annotations to execute arbitrary commands with root privileges on all Flannel nodes in the cluster.
The impact includes full compromise of confidentiality, integrity, and availability of the affected nodes.
Since the attacker gains root-level arbitrary command execution, they can potentially control the entire cluster's network fabric, disrupt services, steal sensitive data, or deploy further attacks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the Flannel Extension backend processing attacker-controlled data from Kubernetes Node annotations without validation, leading to command injection.
Detection involves checking if your Kubernetes cluster is using Flannel with the experimental Extension backend prior to version 0.28.2.
- Inspect Kubernetes Node annotations for the presence of the key `flannel.alpha.coreos.com/backend-data`.
- Use kubectl commands to list node annotations, for example: `kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{": "}{.metadata.annotations.flannel\.alpha\.coreos\.com/backend-data}{"\n"}{end}'`
- Check the Flannel version running on your nodes with commands like `flannel --version` or by inspecting the container image tags if Flannel runs as a pod.
If you find nodes with the vulnerable Flannel version and the Extension backend enabled, and the annotation contains suspicious or unexpected data, this indicates potential exposure.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker with the ability to modify Kubernetes Node annotations to execute arbitrary commands with root privileges on every Flannel node in the cluster. This can lead to a high impact on confidentiality, integrity, and availability of the affected systems.
Such a compromise could potentially result in unauthorized access to sensitive data or disruption of services, which may violate compliance requirements under standards like GDPR or HIPAA that mandate protection of data confidentiality and system integrity.
However, the provided information does not explicitly discuss compliance implications or specific regulatory impacts.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade Flannel to version v0.28.2 or later, where this vulnerability is fixed.
If upgrading immediately is not possible, switch the Flannel backend from the vulnerable Extension backend to a safe alternative such as vxlan or wireguard.
Restrict permissions to modify Kubernetes Node annotations to trusted administrators only, as the vulnerability requires the ability to set these annotations.
Monitor and audit changes to Node annotations to detect any unauthorized modifications.