Loading vulnerability…
OS Command Injection in Chaos Mesh Chaos Controller Manager cleanTcs
CVE-2025-59359 is an OS command injection vulnerability in the cleanTcs GraphQL mutation of Chaos Mesh's Chaos Controller Manager, affecting versions earlier than 2.7.3. The mutation, which removes Linux traffic-control configurations, concatenates attacker-controlled device input into a shell command without adequate neutralization. The resulting command is passed to ExecBypass for execution on target pods through Chaos Daemon. When chained with the missing authentication vulnerability CVE-2025-59358, an unauthenticated attacker with in-cluster network access can invoke the mutation and execute arbitrary commands across the cluster. This vulnerability is part of the vulnerability group collectively named Chaotic Deputy.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise workloads across a Kubernetes cluster through arbitrary command execution. Chaos Daemon's privileged deployment and ability to execute commands in other pods amplify the impact. Attackers may steal Kubernetes service account tokens, access or exfiltrate sensitive data, disrupt services, and move laterally. Depending on available service account privileges and cluster configuration, exploitation can lead to complete cluster takeover.
If you can’t patch tonight, do this now.
If upgrading is not immediately possible, redeploy the Chaos Mesh Helm chart with enableCtrlServer=false to disable the vulnerable controller server. Restricting network access to the controller's GraphQL service can additionally reduce exposure to untrusted workloads.
Patch, then assume compromise.
Upgrade Chaos Mesh to version 2.7.3 or a later release containing the fix.
No validated public exploits yet. Hidden: 1 not loaded here.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.