CVE-2025-59358

Name of the Vulnerable Software and Affected Versions Chaos Mesh versions prior to 2.7.3

Description The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster. This server provides an API that allows attackers to kill arbitrary processes in any Kubernetes pod, potentially leading to a cluster-wide denial of service. The vulnerability stems from a missing authentication check for a critical function within the Chaos Controller Manager.

Recommendations Versions prior to 2.7.3 should be updated to version 2.7.3 or later.