CVE-2026-32241

CVE-2026-32241 is a high-severity command injection vulnerability (CVSS 7.5) in Flannel's experimental Extension backend, affecting versions prior to 0.28.2 in Kubernetes deployments. An attacker with low privileges can exploit this by setting specific Kubernetes Node annotations, leading to root-level arbitrary command execution on all Flannel nodes, despite the high attack complexity. This critical flaw, classified as CWE-77, allows attacker-controlled data to be piped directly to shell commands without validation. There is no evidence of active exploitation or public exploit code, but it has garnered some community discussion. Mitigation involves upgrading to Flannel v0.28.2 or switching to an unaffected backend like vxlan or wireguard.