{"action":"Upgrade github.com/flannel-io/flannel to 0.28.2 or later.","affected":[{"fixed":"0.28.2","introduced":"0"}],"component":"github.com/flannel-io/flannel","cve_ids":["CVE-2026-32241"],"ecosystem":"Go","epss":0.02757,"exploited":false,"fixed_versions":["0.28.2"],"ghsa_id":"GHSA-vchx-5pr6-ffx2","id":"tcs_01M5KGGV0HYN3Q9VMV7HGED326","modified_at":"2026-05-06T20:44:10.025800769Z","published_at":"2026-04-02T18:42:30Z","references":["https://osv.dev/vulnerability/GO-2026-4894","https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2","https://nvd.nist.gov/vuln/detail/CVE-2026-32241","https://github.com/flannel-io/flannel/commit/08bc9a4c990ae785d2fcb448f4991b58485cd26a","https://github.com/flannel-io/flannel/releases/tag/v0.28.2"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GO-2026-4894","url":"https://osv.dev/vulnerability/GO-2026-4894"},{"source":"nvd","source_id":"CVE-2026-32241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32241"}],"summary":"Flannel has cross-node remote code execution via extension backend BackendData injection in github.com/flannel-io/flannel"}