CVE-2025-59358

high

Description

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.

References

References
More

https://www.securityweek.com/in-other-news-600k-hit-by-healthcare-breaches-major-shinyhunters-hacks-deepseeks-coding-bias/

https://www.infosecurity-magazine.com/news/cves-chaos-mesh-cluster-code/

https://www.darkreading.com/cyber-risk/critical-bugs-chaos-mesh-cluster-takeover

https://thehackernews.com/2025/09/chaos-mesh-critical-graphql-flaws.html

https://github.com/mrk336/Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover

https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover

https://github.com/chaos-mesh/chaos-mesh/pull/4702

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-29175

Details

Source: Mitre, NVD

Published: 2025-09-15

Updated: 2026-11-08

Named Vulnerability: Chaotic Deputy

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: High

EPSS

EPSS: 0.00814