Flannel, the networking fabric for Kubernetes, contains a command injection vulnerability in its experimental Extension backend. By inserting crafted data into the Kubernetes Node annotation "flannel.alpha.coreos.com/backend-data", an attacker can have the unvalidated string streamed into a shell command. The result is arbitrary command execution with root privileges on every Flannel node in the cluster. This weakness is a classic command injection (CWE‑77) and carries a high severity, with a CVSS score of 7.5.

The flaw impacts the flannel‑io Flannel project for all releases prior to 0.28.2 when the Extension backend is enabled. Nodes configured with the Extension backend are affected. Stand‑alone backends such as vxlan and wireguard remain unaffected.

The vulnerability is not listed in CISA’s KEV catalog and an EPSS score is not provided, so the exact likelihood of exploitation is unknown. However, the attack path is straightforward for anyone who can write or modify Node annotations, which typically requires cluster administrator privileges. Given the 7.5 CVSS score, the risk to confidentiality, integrity, and availability is significant if the vulnerability is exploited.