External risk intelligence

Chaos Mesh Command Injection Allows Cluster Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-59359

The vulnerability affects Chaos Mesh, a tool designed for chaos engineering within Kubernetes clusters. It requires an in-cluster attacker to trigger the mutation, indicating it is an internal management/testing component. It is not designed to be exposed to the public internet, and such tools are typically isolated within internal network segments or restricted to authorized internal users.

OS Command Injection

Chaos Mesh Chaos Mesh

before 2.7.3

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in Chaos Controller Manager, a component of Chaos Mesh. The issue, when combined with a related CVE, could allow attackers within a Kubernetes cluster to execute arbitrary code remotely. The primary concern is to confirm if this technology is in use and assess potential exposure.

Command injection flaw in Chaos Controller.
Allows in-cluster remote code execution.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by leveraging the cleanTcs mutation within the Chaos Controller Manager. This mutation, when combined with another specific CVE, allows for unauthenticated attackers who are already within the cluster to execute code remotely across the entire cluster.

Attacker is already in the cluster.
Target the cleanTcs mutation.
Allows remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When combined with CVE-2025-59358, this vulnerability could allow unauthenticated attackers within a Kubernetes cluster to execute arbitrary commands on any node, potentially leading to a complete cluster takeover. This exposure is contingent on an attacker already having in-cluster access and the specific mutation being targeted.

Kubernetes cluster control plane.
Unauthenticated, in-cluster attacker.
Complete cluster compromise and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Chaos Controller Manager's `cleanTcs` mutation allows unauthenticated, in-cluster attackers to achieve remote code execution. Teams responsible for Kubernetes infrastructure, platform operations, and security governance should prioritize identifying and assessing affected Chaos Mesh deployments. The first practical step involves locating all instances of Chaos Mesh, verifying their network reachability and business criticality, identifying the accountable system owners, and then developing a risk-based remediation plan.

Kubernetes platform and security teams own the issue.
Verify Chaos Mesh deployment scope and reachability.
Plan remediation and coordinate with vendor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chaos Mesh?

Chaos Mesh is an open-source chaos engineering platform for Kubernetes. Teams use it to test system resilience by injecting controlled failures, like network partitions or pod crashes, into their applications to observe how the cluster handles stress.

What does CVE-2025-59359 mean for software security?

This vulnerability is classified as OS command injection, identified as CWE-78. It means the software does not properly sanitize input before passing it to the underlying operating system. An attacker can exploit this to run unauthorized commands on the host.

How is the cleanTcs mutation triggered?

The flaw is triggered by interacting with the cleanTcs mutation feature in the Chaos Controller Manager. Notably, this is not triggered by standard usage or general network traffic; it requires an attacker to already have an unauthorized presence inside the Kubernetes cluster.

Is my deployment at risk from the internet?

Halo Surface Signal indicates that this is very unlikely. Because Chaos Mesh is designed for internal testing and cluster management, it is typically isolated within internal networks. It is not intended to be exposed directly to the public internet.

Do I need to update my infrastructure?

First, identify all instances of Chaos Mesh running in your environment to understand your footprint. Confirm if you are using versions prior to 2.7.3, coordinate with your system owners, and prioritize a risk-based upgrade path to secure your cluster control plane.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.