Critical Bugs in Chaos Mesh Enable Cluster Takeover

Chaos Mesh, a chaos engineering platform used to test Kubernetes resilience, has four serious flaws collectively dubbed “Chaotic Deputy” that researchers at JFrog say could let an attacker take over an entire Kubernetes cluster.

JFrog assessed three of the vulnerabilities—CVE-2025-59360, CVE-2025-59361 and CVE-2025-59359—as critical (CVSS 9.8), all of which are command-injection flaws enabling arbitrary OS command execution from within a cluster pod and potential access to Kubernetes service tokens to escalate privileges. The fourth flaw, CVE-2025-59358 (CVSS 7.5), is described as enabling a denial-of-service condition across an entire cluster.

JFrog reported the flaws to Chaos Mesh developers in early May, and a repaired version (2.7.3) became available on 21 August; organisations are advised to upgrade as soon as possible or apply the vendor’s workaround. The vulnerabilities require initial access to a Kubernetes cluster, but researchers warn WAN-facing pods can provide a foothold, making Chaos Mesh a high-value target for attackers, according to the JFrog advisory.