Loading vulnerability…
OS Command Injection in Chaos Mesh cleanIptables Mutation
CVE-2025-59361 is an OS command injection vulnerability in the Chaos Controller Manager cleanIptables GraphQL mutation in Chaos Mesh versions before 2.7.3. The mutation concatenates an attacker-controlled chain argument into an iptables flush command without adequate validation, then passes the command to ExecBypass for execution on target pods through Chaos Daemon. Shell metacharacters in the argument can therefore introduce arbitrary commands. When chained with the missing authentication vulnerability CVE-2025-59358, an unauthenticated attacker with cluster-network access can achieve remote code execution across the Kubernetes cluster. The vulnerability is part of the Chaotic Deputy vulnerability group.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary command execution on target pods through Chaos Mesh's privileged execution infrastructure. Consequences can include workload compromise, service disruption, sensitive data exfiltration, and lateral movement. Attackers may steal Kubernetes service account tokens and use their associated permissions to access additional workloads. Depending on available credentials and privileges, exploitation can lead to complete cluster compromise.
If you can’t patch tonight, do this now.
If upgrading is not immediately possible, redeploy the Chaos Mesh Helm chart with enableCtrlServer=false to disable the vulnerable controller server.
Patch, then assume compromise.
Upgrade Chaos Mesh to version 2.7.3 or later, which addresses this vulnerability and the related Chaotic Deputy flaws. Ensure that deployments integrating Chaos Mesh also incorporate the fixed version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.