A critical command injection vulnerability in the Flannel network fabric allows authenticated users with Node annotation privileges to execute arbitrary commands as root across the cluster.

This is a command injection vulnerability (CWE-77) occurring within the experimental Extension backend. An attacker who can modify Kubernetes Node annotations can inject malicious payloads into the SubnetAddCommand or SubnetRemoveCommand functions, which are processed without sufficient sanitization.

The ability to achieve arbitrary command execution at the root level on every node in a Kubernetes cluster presents an extreme risk to the entire containerized infrastructure. A successful exploit could lead to complete cluster takeover, unauthorized access to sensitive data, and persistent compromise of all workloads managed by the affected flannel nodes. Given the CVSS score of 7.5, the high level of impact on confidentiality, integrity, and availability warrants immediate attention from platform engineering teams.

Immediate Action: Update the Flannel network fabric to version 0.28.2 or higher across all nodes.

Proactive Monitoring: Audit Kubernetes audit logs for suspicious modifications to Node annotations, specifically focusing on the flannel.alpha.coreos.com/backend-data key.

Compensating Controls: If upgrading is not immediately feasible, switch the Flannel configuration to use standard backends like vxlan or wireguard, as the vulnerable Extension backend is the specific attack vector.

Public Exploit Available: exploit_available (unknown)

This vulnerability represents a significant security risk for Kubernetes environments using the Flannel Extension backend. Administrators should prioritize the upgrade to version 0.28.2 to eliminate the command injection vector entirely. If the Extension backend is not required for production operations, it is strongly recommended to migrate to more stable and secure backends such as vxlan to reduce the attack surface.