Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2025-59359: Chaos Mesh lets unauthenticated users run code in cluster
CVE-2025-59359 · published 1 year ago
Summary
The cleanTcs feature in Chaos Mesh’s controller can be tricked into executing commands on the host. An attacker inside the same Kubernetes cluster could use this to run their own code across the whole system. Apply the latest security update or patch the controller to stop the problem.
What to do
- Update github.com chaos-mesh to version 2.7.3.
- Update chaos-mesh chaos_mesh to version 2.7.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | chaos-mesh |
< 2.7.3 Fix: upgrade to 2.7.3
|
| – | chaos-mesh | chaos_mesh |
< 2.7.3 cpe:2.3:a:chaos-mesh:chaos_mesh:*:*:*:*:*:*:*:* |
Original advisory text
OS command injection in Chaos Mesh via the cleanTcs mutation
The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
References
- https://github.com/chaos-mesh/chaos-mesh/commit/67281c36f8068bf103149318cd0a4664...
- https://github.com/advisories/GHSA-369h-6j28-wwcg
- https://nvd.nist.gov/vuln/detail/CVE-2025-59359 Vendor Advisory
- https://github.com/chaos-mesh/chaos-mesh/pull/4702 Patch
- https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lea... Third Party Advisory
- https://go.dev URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59359... Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-78OS Command Injection
Timeline
Published15 Sep 2025
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta