CVE-2026-32241

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32241", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-11T14:47:05.684Z", "datePublished": "2026-03-27T19:31:48.276Z", "dateUpdated": "2026-03-31T18:54:30.192Z"}, "containers": {"cna": {"title": "Flannel vulnerable to cross-node remote code execution via extension backend BackendData injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "lang": "en", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2"}, {"name": "https://github.com/flannel-io/flannel/releases/tag/v0.28.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/flannel-io/flannel/releases/tag/v0.28.2"}], "affected": [{"vendor": "flannel-io", "product": "flannel", "versions": [{"version": "< 0.28.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T19:31:48.276Z"}, "descriptions": [{"lang": "en", "value": "Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execution on every flannel node in the cluster. The Extension backend's SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via stdin (from the `flannel.alpha.coreos.com/backend-data` Node annotation). The content of this annotation is unmarshalled and piped directly to a shell command without checks. Kubernetes clusters using Flannel with the Extension backend are affected by this vulnerability. Other backends such as vxlan and wireguard are unaffected. The vulnerability is fixed in version v0.28.2. As a workaround, use Flannel with another backend such as vxlan or wireguard."}], "source": {"advisory": "GHSA-vchx-5pr6-ffx2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-31T18:51:18.552973Z", "id": "CVE-2026-32241", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T18:54:30.192Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32241", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-31T18:51:18.552973Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T18:51:19.570Z"}}], "cna": {"title": "Flannel vulnerable to cross-node remote code execution via extension backend BackendData injection", "source": {"advisory": "GHSA-vchx-5pr6-ffx2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "flannel-io", "product": "flannel", "versions": [{"status": "affected", "version": "< 0.28.2"}]}], "references": [{"url": "https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2", "name": "https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/flannel-io/flannel/releases/tag/v0.28.2", "name": "https://github.com/flannel-io/flannel/releases/tag/v0.28.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execution on every flannel node in the cluster. The Extension backend's SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via stdin (from the `flannel.alpha.coreos.com/backend-data` Node annotation). The content of this annotation is unmarshalled and piped directly to a shell command without checks. Kubernetes clusters using Flannel with the Extension backend are affected by this vulnerability. Other backends such as vxlan and wireguard are unaffected. The vulnerability is fixed in version v0.28.2. As a workaround, use Flannel with another backend such as vxlan or wireguard."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T19:31:48.276Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32241", "state": "PUBLISHED", "dateUpdated": "2026-03-31T18:54:30.192Z", "dateReserved": "2026-03-11T14:47:05.684Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-27T19:31:48.276Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "flannel", "vendor": "flannel-io", "versions": [{"status": "affected", "version": "< 0.28.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:flannel-io:flannel:*:*:*:*:*:kubernetes:*:*", "matchCriteriaId": "8670D1E4-2A5B-42ED-94C1-F8AFCD308809", "versionEndExcluding": "0.28.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execution on every flannel node in the cluster. The Extension backend's SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via stdin (from the `flannel.alpha.coreos.com/backend-data` Node annotation). The content of this annotation is unmarshalled and piped directly to a shell command without checks. Kubernetes clusters using Flannel with the Extension backend are affected by this vulnerability. Other backends such as vxlan and wireguard are unaffected. The vulnerability is fixed in version v0.28.2. As a workaround, use Flannel with another backend such as vxlan or wireguard."}, {"lang": "es", "value": "Flannel es un tejido de red para contenedores, dise\u00f1ado para Kubernetes. El proyecto Flannel incluye un backend de Extensi\u00f3n experimental que permite a los usuarios prototipar f\u00e1cilmente nuevos tipos de backend. En versiones de Flannel anteriores a la 0.28.2, este backend de Extensi\u00f3n es vulnerable a una inyecci\u00f3n de comandos que permite a un atacante que puede establecer anotaciones de Nodo de Kubernetes lograr la ejecuci\u00f3n arbitraria de comandos a nivel de root en cada nodo flannel del cl\u00faster. Los comandos SubnetAddCommand y SubnetRemoveCommand del backend de Extensi\u00f3n reciben datos controlados por el atacante a trav\u00e9s de stdin (de la anotaci\u00f3n de Nodo \u2019flannel.alpha.coreos.com/backend-data\u2019). El contenido de esta anotaci\u00f3n se deserializa y se canaliza directamente a un comando de shell sin comprobaciones. Los cl\u00fasteres de Kubernetes que utilizan Flannel con el backend de Extensi\u00f3n se ven afectados por esta vulnerabilidad. Otros backends como vxlan y wireguard no se ven afectados. La vulnerabilidad se corrige en la versi\u00f3n v0.28.2. Como soluci\u00f3n alternativa, utilice Flannel con otro backend como vxlan o wireguard."}], "id": "CVE-2026-32241", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32241", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-31T18:51:18.552973Z", "version": "2.0.3"}}]}, "published": "2026-03-27T20:16:30.570", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/flannel-io/flannel/releases/tag/v0.28.2"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.28.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "flannel", "source": "cna", "vendor": "flannel-io"}, "product": "flannel", "vendor": "flannel-io"}], "created": "2026-03-27T20:27:31.373302+00:00", "updated": "2026-06-18T13:30:05.902341+00:00", "vendors": ["flannel-io", "flannel-io$PRODUCT$flannel"]}