{"action":"Upgrade github.com/flannel-io/flannel to 0.28.2 or later.","affected":[{"fixed":"0.28.2","introduced":"0"}],"component":"github.com/flannel-io/flannel","cve_ids":["CVE-2026-32241"],"ecosystem":"Go","epss":0.02757,"exploited":false,"fixed_versions":["0.28.2"],"ghsa_id":"GHSA-vchx-5pr6-ffx2","id":"tcs_01M5KFNZJS11Y6YFB33V262RSF","modified_at":"2026-09-10T03:50:41.275757864Z","published_at":"2026-03-27T20:28:13Z","references":["https://osv.dev/vulnerability/GHSA-vchx-5pr6-ffx2","https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2","https://nvd.nist.gov/vuln/detail/CVE-2026-32241","https://github.com/flannel-io/flannel/commit/08bc9a4c990ae785d2fcb448f4991b58485cd26a","https://github.com/flannel-io/flannel","https://github.com/flannel-io/flannel/releases/tag/v0.28.2"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-vchx-5pr6-ffx2","url":"https://osv.dev/vulnerability/GHSA-vchx-5pr6-ffx2"}],"summary":"Flannel has cross-node remote code execution via extension backend BackendData injection"}