CVE-2025-59358

HIGH

Chaos Mesh < 2.7.3 - Unauthenticated Denial of Service via GraphQL Debugging Server

Title source: llm

Description

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.

References (2)

Core 2

Core References

Issue Tracking, Patch

https://github.com/chaos-mesh/chaos-mesh/pull/4702

Exploit, Third Party Advisory

https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover

Scores

CVSS v3 7.5

EPSS 0.0099

EPSS Percentile 57.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-306

Status published

Products (2)

chaos-mesh/chaos-mesh 0 - 2.7.3Go

chaos-mesh/chaos_mesh < 2.7.3

Published Sep 15, 2025

Tracked Since Feb 18, 2026