CVE-2025-59359
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk88th percentile - higher than 88% of all known CVEs
Summary
The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
Risk Assessment
An attacker with cluster access can execute arbitrary commands on nodes, leading to cluster takeover and a serious security breach.
Recommendation
Update Chaos Mesh to a patched version and restrict access to the GraphQL server and cluster network.
Other vulnerabilities in Chaos Mesh
See all- CVE-2025-59361Critical
The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
- CVE-2025-59360Critical
The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
- CVE-2025-59358High
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.
Original NVD description (English source)
The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS