TI-2025-36918 CVE-2025-59359 · GHSA-369h-6j28-wwcg
OS command injection in Chaos Mesh via the cleanTcs mutation
Priority MEDIUM 54
The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection.
Chaos-mesh
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Chaos-mesh records in CISA KEVNo Chaos-mesh vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records
TI-2025-36920 CVE-2025-59361 · GHSA-2gcv-3qpf-c5qr
OS command injection in Chaos Mesh via the cleanIptables mutation
Priority MEDIUM 49
The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection.
TI-2025-36919 CVE-2025-59360 · GHSA-xv9f-728h-9jgv
OS command injection in Chaos Mesh via the killProcesses mutation
Priority MEDIUM 48
The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection.
TI-2024-24307 CVE-2024-36538 · GHSA-3hrc-rv3v-p6h6
Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and…
Priority MEDIUM 41
Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
TI-2025-36917 CVE-2025-59358 · GHSA-2gg8-85m5-8r2p
Denial of Service via Unauthorized Access to Chaos Mesh debugging server
Priority MEDIUM 40
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to c…