CVE-2026-32241

Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execution on every flannel node in the cluster. The Extension backend's SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via stdin (from the `flannel.alpha.coreos.com/backend-data` Node annotation). The content of this annotation is unmarshalled and piped directly to a shell command without checks. Kubernetes clusters using Flannel with the Extension backend are affected by this vulnerability. Other backends such as vxlan and wireguard are unaffected. The vulnerability is fixed in version v0.28.2. As a workaround, use Flannel with another backend such as vxlan or wireguard.

• CWE-77

• https://github.com/flannel-io/flannel/releases/tag/v0.28.2Product, Release Notes
• https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2Mitigation, Vendor Advisory

Published

Mar 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32236Backstage is an open framework for building developer portal…7.5
• CVE-2026-32237Backstage is an open framework for building developer portal…6.5
• CVE-2026-32238OpenEMR is a free and open source electronic health records …9.1
• CVE-2026-32239Cap'n Proto is a data interchange format and capability-base…6.5
• CVE-2026-3224Authentication bypass in the Microsoft Entra ID (Azure AD) a…9.8
• CVE-2026-32240Cap'n Proto is a data interchange format and capability-base…6.5
• CVE-2026-32242Parse Server is an open source backend that can be deployed …7.4
• CVE-2026-32243Discourse is an open-source discussion platform. From versio…5.4
• CVE-2026-32244Discourse is an open-source discussion platform. In versions…5.3
• CVE-2026-32245Tinyauth is an authentication and authorization server. Prio…6.5
• CVE-2026-32246Tinyauth is an authentication and authorization server. Prio…7.1
• CVE-2026-32247Graphiti is a framework for building and querying temporal c…8.1