CVE-2025-59358
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.
Risk Assessment
An unauthenticated in-cluster attacker can kill processes in arbitrary pods, causing widespread denial of service and destabilizing the environment.
Recommendation
Update Chaos Mesh to a patched version and restrict access to the GraphQL server and cluster network.
Other vulnerabilities in Chaos Mesh
See all- CVE-2025-59361Critical
The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
- CVE-2025-59360Critical
The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
- CVE-2025-59359Critical
The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
Original NVD description (English source)
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS