Executive Summary

CVE-2026-32241 is a command injection vulnerability in the Flannel Kubernetes networking project's experimental Extension backend in versions prior to 0.28.2.

The Extension backend allows users to prototype new backend types by executing shell commands stored in Kubernetes Node annotations.

The vulnerability occurs because the SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via the 'flannel.alpha.coreos.com/backend-data' Node annotation, which is unmarshalled and piped directly to a shell command without validation or sanitization.

An attacker who can modify Kubernetes Node annotations can exploit this to execute arbitrary commands with root privileges on every Flannel node in the cluster.

Other Flannel backends such as vxlan and wireguard are not affected by this vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a severe impact because it allows an attacker with the ability to modify Kubernetes Node annotations to execute arbitrary commands with root privileges on all Flannel nodes in the cluster.

The impact includes full compromise of confidentiality, integrity, and availability of the affected nodes.

Since the attacker gains root-level arbitrary command execution, they can potentially control the entire cluster's network fabric, disrupt services, steal sensitive data, or deploy further attacks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the Flannel Extension backend processing attacker-controlled data from Kubernetes Node annotations without validation, leading to command injection.

Detection involves checking if your Kubernetes cluster is using Flannel with the experimental Extension backend prior to version 0.28.2.

• Inspect Kubernetes Node annotations for the presence of the key `flannel.alpha.coreos.com/backend-data`.
• Use kubectl commands to list node annotations, for example: `kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{": "}{.metadata.annotations.flannel\.alpha\.coreos\.com/backend-data}{"\n"}{end}'`
• Check the Flannel version running on your nodes with commands like `flannel --version` or by inspecting the container image tags if Flannel runs as a pod.

If you find nodes with the vulnerable Flannel version and the Extension backend enabled, and the annotation contains suspicious or unexpected data, this indicates potential exposure.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Flannel to version v0.28.2 or later, where this vulnerability is fixed.

If upgrading immediately is not possible, switch the Flannel backend from the vulnerable Extension backend to a safe alternative such as vxlan or wireguard.

Restrict permissions to modify Kubernetes Node annotations to trusted administrators only, as the vulnerability requires the ability to set these annotations.

Monitor and audit changes to Node annotations to detect any unauthorized modifications.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker with the ability to modify Kubernetes Node annotations to execute arbitrary commands with root privileges on every Flannel node in the cluster. This can lead to a high impact on confidentiality, integrity, and availability of the affected systems.

Such a compromise could potentially result in unauthorized access to sensitive data or disruption of services, which may violate compliance requirements under standards like GDPR or HIPAA that mandate protection of data confidentiality and system integrity.

However, the provided information does not explicitly discuss compliance implications or specific regulatory impacts.

Useful 0 Not Useful 0