Critical 'Chaotic Deputy' Vulnerabilities in Chaos Mesh Allow Kubernetes Cluster Takeover
3 sources · Updated 4mo ago · First seen Sep 18, 2025
JFrog researchers have discovered four serious vulnerabilities in the Chaos Mesh chaos engineering platform, three of which are rated critical (CVSS 9.8). These flaws allow attackers with initial access to a Kubernetes cluster to execute arbitrary OS commands and potentially take over the entire cluster. Organizations using Chaos Mesh are urged to upgrade to version 2.7.3 immediately to mitigate risk.
Do you run this?See affected versions and whether adversaries are exploiting it against assets like yours.
Check your exposure
