CVE-2025-59358

HighCVSS 7.5/10Last modified Nov 8, 2026

Description

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
—	—	<= 2.7.2

References

https://github.com/chaos-mesh/chaos-mesh/pull/4702Issue Tracking, Patch
https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeoverExploit, Third Party Advisory

Timeline

Published: Sep 15, 2025
Last modified: Nov 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-593599.8The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows un CVE-2025-59364.3The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to CVE-2025-593609.8The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allow CVE-2025-593619.8The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allow CVE-2025-593624.0Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_objid in lib/snmplib/asn1.c.CVE-2025-593637.7In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only CVE-2025-593645.3The express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in lib/CVE-2025-593656.9A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability CVE-2025-593669.2An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba func CVE-2025-593679.8An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized ac CVE-2025-593686.0An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerability by sending a cra CVE-2025-593695.9A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentiall