Microsoft security update for CVE-2026-32241
🔗 CVE IDs covered (1)
📋 Microsoft's advisory
EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32241. This page also shows what EchelonGraph holds for CVE-2026-32241, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.
🎯 Affected products4
- azl3 flannel 0.24.2-24 on Azure Linux 3.0
- azl3 flannel 0.24.2-26 on Azure Linux 3.0
- cbl2 flannel 0.14.0-30 on CBL Mariner 2.0
- cbl2 flannel 0.14.0-30 on CBL-Mariner 2.0
✅ Updates Microsoft lists: 2 updates
2 rows: one per KB article or update, update type and fixed build. Their details are on Microsoft's advisory.
| KB article | Update | Fixed build |
|---|---|---|
| — | Security Update | 0.24.2-25 |
| — | Security Update | 0.14.0-31 |
🧭 EchelonGraph on CVE-2026-32241
- EchelonGraph score
- 8.8 HIGH
- CISA KEV
- Not listed
- Fix status
- A fix is available — apply it.
Description from the CVE record (CVE.org), as published by its numbering authority
Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execution on every flannel node in the cluster. The Extension backend's SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via stdin (from the `flannel.alpha.coreos.com/backend-data` Node annotation). The content of this annotation is unmarshalled and piped directly to a shell command without checks. Kubernetes clusters using Flannel with the Extension backend are affected by this vulnerability. Other backends such as vxlan and wireguard are unaffected. The vulnerability is fixed in version v0.28.2. As a workaround, use Flannel with another backend such as vxlan or wireguard.
Published by GitHub, Inc., the CVE Numbering Authority that assigned CVE-2026-32241, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).