The vulnerability is a command‑injection flaw (CWE‑77) in Flannel’s experimental Extension backend. The SubnetAddCommand and SubnetRemoveCommand read data supplied via the Kubernetes node annotation flannel.alpha.coreos.com/backend-data and pipe it directly into a shell without validation. An attacker who can set or modify this annotation can therefore inject arbitrary shell commands. The vulnerability allows an attacker to execute commands with root privileges on every node running Flannel, potentially compromising the entire cluster, as root‑level code execution compromises confidentiality, integrity and availability at a system level.

Flannel, the network fabric for Kubernetes, is affected in all releases prior to v0.28.2 when the Extension backend is used. The vulnerability does not impact other supported backends such as vxlan or wireguard. A cluster that has enabled the Extension backend and allows untrusted users to modify node annotations is therefore susceptible.

The CVSS score of 7.5 indicates high severity, while the EPSS score of 3% reflects a moderate but non‑negligible likelihood that the vulnerability will be actively exploited. The vulnerability is not listed in the CISA KEV catalog, but the ability to reach any node and execute commands as root makes it a high‑risk condition for any cluster where node annotations are writable without strict access controls. Exploitation requires the attacker to have write permissions to the flannel.alpha.coreos.com/backend-data annotation; once achieved, arbitrary command execution is straightforward and full control of the nodes is possible.