CVE-2025-59361

CriticalCVSS 9.8/10Last modified Nov 8, 2026

Description

The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
—	—	<= 2.7.2

References

https://github.com/chaos-mesh/chaos-mesh/pull/4702Issue Tracking
https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeoverExploit, Third Party Advisory

Timeline

Published: Sep 15, 2025
Last modified: Nov 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-593624.0Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_objid in lib/snmplib/asn1.c.CVE-2025-593637.7In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only CVE-2025-593645.3The express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in lib/CVE-2025-593656.9A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability CVE-2025-593669.2An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba func CVE-2025-593679.8An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized ac CVE-2025-593686.0An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerability by sending a cra CVE-2025-593695.9A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentiall CVE-2025-59374.3The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Reques CVE-2025-593707.5A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potent CVE-2025-593717.5An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage CVE-2025-593726.9A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerabili