PT-2025-37473 · Unknown · Chaos-Mesh

Natan Nehorai · Published 2025-09-15 · Updated 2025-10-06 · CVE-2025-59358

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Chaos Mesh versions prior to 2.7.3

Description The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster. This server provides an API that allows attackers to kill arbitrary processes in any Kubernetes pod, potentially leading to a cluster-wide denial of service. The vulnerability stems from a missing authentication check for a critical function within the Chaos Controller Manager.

Recommendations Versions prior to 2.7.3 should be updated to version 2.7.3 or later.

Exploit

Fix

DoS

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-59358

GHSA-2GG8-85M5-8R2P

GO-2025-3951

OPENSUSE-SU-2025:15564-1

SUSE-SU-2025:03289-1

Affected Products

Chaos-Mesh

References · 68

• 🔥 https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover · Exploit
• https://github.com/chaos-mesh/chaos-mesh/pull/4702 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-59358 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:03289-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2gg8-85m5-8r2p · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3951 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15564-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59358 · Vendor Advisory
• https://github.com/chaos-mesh/chaos-mesh/commit/67281c36f8068bf103149318cd0a466417213a28 · Note
• https://github.com/chaos-mesh/chaos-mesh · Note
• https://suse.com/security/cve/CVE-2025-54376 · Note
• https://suse.com/security/cve/CVE-2025-58430 · Note
• https://suse.com/security/cve/CVE-2025-58437 · Note
• https://suse.com/security/cve/CVE-2025-8396 · Note
• https://suse.com/security/cve/CVE-2025-58158 · Note