CVE-2026-32241: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') in flannel-io flannel
Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execution on every flannel node in the cluster. The Extension backend's SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via stdin (from the `flannel.alpha.coreos.com/backend-data` Node annotation). The content of this annotation is unmarshalled and piped directly to a shell command without checks. Kubernetes clusters using Flannel with the Extension backend are affected by this vulnerability. Other backends such as vxlan and wireguard are unaffected. The vulnerability is fixed in version v0.28.2. As a workaround, use Flannel with another backend such as vxlan or wireguard.
AI Analysis
Technical Summary
Flannel versions prior to 0.28.2 contain a command injection vulnerability (CWE-77) in the experimental Extension backend. This backend processes Kubernetes Node annotations that can be controlled by an attacker with limited privileges. The vulnerability occurs because the backend unmarshals the 'flannel.alpha.coreos.com/backend-data' annotation and pipes its content directly to shell commands (SubnetAddCommand and SubnetRemoveCommand) without validation, enabling root-level arbitrary command execution on all flannel nodes in the cluster. Other backends like vxlan and wireguard are unaffected. The vulnerability is addressed in Flannel 0.28.2, and users are advised to upgrade or switch to a different backend.
Potential Impact
Successful exploitation allows an attacker who can modify Kubernetes Node annotations to execute arbitrary commands with root privileges on every flannel node in the cluster. This can lead to full compromise of the affected nodes, impacting confidentiality, integrity, and availability of the cluster's network fabric. The vulnerability affects only the experimental Extension backend and not other backends such as vxlan or wireguard.
Mitigation Recommendations
A fix is available in Flannel version 0.28.2. Users should upgrade to this version to remediate the vulnerability. As an alternative workaround, users can switch to other Flannel backends like vxlan or wireguard, which are not affected by this issue. Patch status is confirmed fixed in version 0.28.2.
CVE-2026-32241: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') in flannel-io flannel
Description
Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execution on every flannel node in the cluster. The Extension backend's SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via stdin (from the `flannel.alpha.coreos.com/backend-data` Node annotation). The content of this annotation is unmarshalled and piped directly to a shell command without checks. Kubernetes clusters using Flannel with the Extension backend are affected by this vulnerability. Other backends such as vxlan and wireguard are unaffected. The vulnerability is fixed in version v0.28.2. As a workaround, use Flannel with another backend such as vxlan or wireguard.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Flannel versions prior to 0.28.2 contain a command injection vulnerability (CWE-77) in the experimental Extension backend. This backend processes Kubernetes Node annotations that can be controlled by an attacker with limited privileges. The vulnerability occurs because the backend unmarshals the 'flannel.alpha.coreos.com/backend-data' annotation and pipes its content directly to shell commands (SubnetAddCommand and SubnetRemoveCommand) without validation, enabling root-level arbitrary command execution on all flannel nodes in the cluster. Other backends like vxlan and wireguard are unaffected. The vulnerability is addressed in Flannel 0.28.2, and users are advised to upgrade or switch to a different backend.
Potential Impact
Successful exploitation allows an attacker who can modify Kubernetes Node annotations to execute arbitrary commands with root privileges on every flannel node in the cluster. This can lead to full compromise of the affected nodes, impacting confidentiality, integrity, and availability of the cluster's network fabric. The vulnerability affects only the experimental Extension backend and not other backends such as vxlan or wireguard.
Mitigation Recommendations
A fix is available in Flannel version 0.28.2. Users should upgrade to this version to remediate the vulnerability. As an alternative workaround, users can switch to other Flannel backends like vxlan or wireguard, which are not affected by this issue. Patch status is confirmed fixed in version 0.28.2.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-11T14:47:05.684Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69c6de373c064ed76fea1d6e
Added to database: 3/27/2026, 7:44:55 PM
Last enriched: 4/4/2026, 10:50:52 AM
Last updated: 5/11/2026, 5:09:22 AM
Views: 80
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.