Flannel Extension backend: Node annotation data piped to a shell gives root on every flannel node

Impact

An attacker who can write the flannel.alpha.coreos.com/backend-data annotation on a Node object gets arbitrary commands run as root on every node running flannel, because the Extension backend's SubnetAddCommand and SubnetRemoveCommand pipe that annotation content straight into a shell. One write to the Kubernetes API turns into cluster-wide host root. On a GPU cluster that means every GPU node, its tenant workloads and its mounted credentials. Only clusters configured with the experimental Extension backend are affected. The vxlan and wireguard backends are not.

Who can reach it

Any identity that can set annotations on Kubernetes Node objects. This needs authenticated Kubernetes API access with node update or patch rights. In a typical cluster that is admins, some controllers, and possibly a node's own credentials for its own Node object. Only clusters using the Extension backend are exposed.

What to do

Upgrade flannel to v0.28.2. This is a rolling restart of the flannel DaemonSet pods. As a workaround, move off the Extension backend to vxlan or wireguard. Plan that as a network change, because switching backends affects pod networking on every node. Also check which identities hold node update or patch rights.

References

Related entries

• ingress-nginx: rewrite-target annotation injects nginx configCVE-2026-3288 · ingress-nginxHigh
• Coolify: unescaped single quotes in custom compose commands escape the container and run on the hostCVE-2026-34158 · Coolify (executeInDocker quoting of docker_compose_custom_build_command / start_command)High
• ingress-nginx: Comment-based nginx configuration injectionCVE-2026-4342 · ingress-nginxHigh
• BentoML (Dockerfile template, docker.base_image interpolation): A multi-line docker.base_image value in bento.yamlCVE-2026-44345 · BentoML (Dockerfile template, docker.base_image interpolation)High
• mcp-server-kubernetes: read-only and allowed-tool restrictions are not enforced at tool executionCVE-2026-46519 · mcp-server-kubernetes (ALLOW_ONLY_READONLY_TOOLS / ALLOWED_TOOLS enforcement)High
• Argo CD repo-server: shell metacharacters in a repository proxy URL run commands and leak Git/Helm/OCI credentialsCVE-2026-55797 · Argo CD repo-server (SSH repository proxy ProxyCommand)High