Flannel vulnerable to cross-node remote code execution via extension backend BackendData injection

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-32241 · CVE overview and exploitation status

EUVD-2026-16771

GHSA-vchx-5pr6-ffx2

GO-2026-4894

cve-program · CVE-2026-32241

• https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2
• https://github.com/flannel-io/flannel/releases/tag/v0.28.2

euvd · EUVD-2026-16771

• https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2
• https://github.com/flannel-io/flannel/releases/tag/v0.28.2

nvd · CVE-2026-32241

• https://github.com/flannel-io/flannel/releases/tag/v0.28.2
• https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2

osv · GHSA-vchx-5pr6-ffx2

• https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2
• https://nvd.nist.gov/vuln/detail/CVE-2026-32241
• https://github.com/flannel-io/flannel/commit/08bc9a4c990ae785d2fcb448f4991b58485cd26a
• https://github.com/flannel-io/flannel
• https://github.com/flannel-io/flannel/releases/tag/v0.28.2

osv · GO-2026-4894

• https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2
• https://nvd.nist.gov/vuln/detail/CVE-2026-32241
• https://github.com/flannel-io/flannel/commit/08bc9a4c990ae785d2fcb448f4991b58485cd26a
• https://github.com/flannel-io/flannel/releases/tag/v0.28.2

• Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extens… · Advisory content revised · 30 Oct 2026