Chaos Mesh Critical Vulnerabilities Expose Kubernetes Clusters to Takeover

Security Research recently uncovered four CVEs—CVE-2025-59358, CVE-2025-59359, CVE-2025-59360, and CVE-2025-59361—in the default configuration of Chaos Mesh, a popular open‑source Chaos Engineering platform for Kubernetes, exposed via the Chaos Controller Manager GraphQL server.

Three of the flaws carry a maximum CVSS 3.1 score of 9.8, enabling any pod in the cluster to run arbitrary commands or inject faults in other pods without authentication, while the first allows unauthenticated access to the GraphQL playground and query endpoint, potentially leading to DoS and unauthorized fault injections. Exploitation requires in‑cluster network access, and a single GraphQL mutation can shut down the Kubernetes API server pod, causing a cluster‑wide DoS.

The affected Chaos Mesh versions are earlier than 2.7.3, and Azure Chaos Studio for AKS users are also impacted if using affected releases. Mitigation centres on upgrading to Chaos Mesh 2.7.3, and, if upgrading is not feasible, re‑deployments with the control server disabled using specified Helm commands, alongside continuous monitoring and restricted network access to the controller service.