Loading vulnerability…
Unauthenticated GraphQL Process Termination in Chaos Mesh
CVE-2025-59358 is a missing-authentication vulnerability in the Chaos Controller Manager of Chaos Mesh versions earlier than 2.7.3. A GraphQL debugging server enabled by default is exposed across the Kubernetes cluster network without authentication or authorization. An unauthenticated attacker with network access can invoke native fault-injection operations, including the killProcesses mutation, to terminate arbitrary processes in cluster pods. The vulnerability is part of the Chaotic Deputy vulnerability set and can independently cause cluster-wide denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers can disrupt workloads and critical Kubernetes components by terminating processes in targeted pods, including the Kubernetes API server pod. Repeated exploitation can cause sustained, cluster-wide denial of service. When chained with the separate command-injection vulnerabilities CVE-2025-59359, CVE-2025-59360, or CVE-2025-59361, unauthenticated GraphQL access can additionally enable arbitrary command execution, service-account token theft, lateral movement, and potentially complete cluster compromise; those outcomes require the additional vulnerabilities.
If you can’t patch tonight, do this now.
If upgrading is not immediately possible, redeploy the Chaos Mesh Helm chart with enableCtrlServer=false to disable the Controller Manager debugging server. Restrict network access to the Controller Manager debugging interface to trusted administrative workloads as defense in depth.
Patch, then assume compromise.
Upgrade Chaos Mesh to version 2.7.3 or a later release containing the fixes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.