Chaos Mesh vulnerabilities
5 vulnerabilities
Known vulnerabilities in Chaos Mesh, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
PrioritiseCVE-2025-59361chaos-mesh · chaos_mesh +1 moreOS command injection in Chaos Mesh via the cleanIptables mutationThe cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.CVSS9.8CriticalEPSS3.38%PrioritiseCVE-2025-59360chaos-mesh · chaos_mesh +1 moreOS command injection in Chaos Mesh via the killProcesses mutationThe killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.CVSS9.8CriticalEPSS2.92%PrioritiseCVE-2025-59359chaos-mesh · chaos_mesh +1 moreOS command injection in Chaos Mesh via the cleanTcs mutationThe cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.CVSS9.8CriticalEPSS3.03%PrioritiseCVE-2025-59358chaos-mesh · chaos_mesh +1 moreDenial of Service via Unauthorized Access to Chaos Mesh debugging serverThe Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.CVSS7.5HighEPSS0.81%PrioritiseCVE-2024-36538chaos-mesh · chaos_meshchaos-mesh chaos_meshInsecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.CVSS8.8HighEPSS0.57%