{"id":"CVE-2026-32241","sourceIdentifier":"security-advisories@github.com","published":"2026-03-27T20:16:30.570","lastModified":"2026-11-11T23:10:00.263","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection  that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execution on every flannel node in the cluster. The Extension backend's SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via stdin (from the `flannel.alpha.coreos.com/backend-data` Node annotation). The content of this annotation is unmarshalled and piped directly to a shell command without checks. Kubernetes clusters using Flannel with the Extension backend are affected by this vulnerability. Other backends such as vxlan and wireguard are unaffected. The vulnerability is fixed in version v0.28.2. As a workaround, use Flannel with another backend such as vxlan or wireguard."},{"lang":"es","value":"Flannel es un tejido de red para contenedores, diseñado para Kubernetes. El proyecto Flannel incluye un backend de Extensión experimental que permite a los usuarios prototipar fácilmente nuevos tipos de backend. En versiones de Flannel anteriores a la 0.28.2, este backend de Extensión es vulnerable a una inyección de comandos que permite a un atacante que puede establecer anotaciones de Nodo de Kubernetes lograr la ejecución arbitraria de comandos a nivel de root en cada nodo flannel del clúster. Los comandos SubnetAddCommand y SubnetRemoveCommand del backend de Extensión reciben datos controlados por el atacante a través de stdin (de la anotación de Nodo ’flannel.alpha.coreos.com/backend-data’). El contenido de esta anotación se deserializa y se canaliza directamente a un comando de shell sin comprobaciones. Los clústeres de Kubernetes que utilizan Flannel con el backend de Extensión se ven afectados por esta vulnerabilidad. Otros backends como vxlan y wireguard no se ven afectados. La vulnerabilidad se corrige en la versión v0.28.2. Como solución alternativa, utilice Flannel con otro backend como vxlan o wireguard."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"flannel-io","product":"flannel","versions":[{"version":"< 0.28.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-31T18:51:18.552973Z","id":"CVE-2026-32241","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:flannel-io:flannel:*:*:*:*:*:kubernetes:*:*","versionEndExcluding":"0.28.2","matchCriteriaId":"8670D1E4-2A5B-42ED-94C1-F8AFCD308809"}]}]}],"references":[{"url":"https://github.com/flannel-io/flannel/releases/tag/v0.28.2","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}