External risk intelligence

Chaos Mesh Command Injection Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-59360

Chaos Mesh is a chaos engineering tool designed for internal testing within Kubernetes clusters. It is intended for controlled environments rather than public internet exposure. The vulnerable component operates within the cluster infrastructure, and common deployment patterns involve isolated internal networks, making public internet reachability for this specific mutation highly unlikely.

OS Command Injection

Chaos Mesh Chaos Mesh

before 2.7.3

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability within the Chaos Controller Manager, specifically a flaw in its `killProcesses` function. When combined with another known issue, this vulnerability could allow unauthorized attackers to execute arbitrary code remotely across the entire Kubernetes cluster. The primary concern is to confirm if our environment utilizes this specific technology and is exposed.

Command injection flaw in controller.
Critical cluster takeover risk.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could leverage unauthenticated access to the Chaos Controller Manager to inject operating system commands through the `killProcesses` mutation. This vulnerability, when combined with another issue, could allow for remote code execution across the entire cluster.

Unauthenticated in-cluster access required.
Triggered by the `killProcesses` mutation.
Leads to cluster-wide remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers within a Kubernetes cluster to execute arbitrary commands on the cluster's systems. This is possible when the `killProcesses` mutation is used in conjunction with another vulnerability, potentially impacting the integrity and availability of cluster resources.

Cluster system commands and data.
Through the `killProcesses` mutation.
Cluster-wide remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are primarily responsible for addressing this critical vulnerability within the Chaos Controller Manager. The first practical step involves identifying all instances of the affected technology, confirming their reachability and business criticality, and then locating the accountable owner to plan remediation based on the identified risk.

Application and platform teams own the issue.
Verify internal and external exposure of Chaos Controller.
Plan targeted remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chaos Mesh and what is it used for?

Chaos Mesh is an open-source chaos engineering platform built for Kubernetes. Teams use it to inject faults into their clusters, such as simulating network latency, pod failures, or system stress, to test how resilient their applications and infrastructure are when things go wrong.

What does CWE-78 mean for CVE-2025-59360?

CWE-78 refers to OS Command Injection. In the context of CVE-2025-59360, it means the software fails to properly sanitize input before passing it to a system shell. Because of this weakness, an attacker can supply malicious commands that the Chaos Controller Manager executes with system-level privileges.

How is the killProcesses vulnerability triggered?

The flaw is triggered by sending a specific request to the killProcesses mutation within the Chaos Controller Manager. Simply having the software installed is not enough; the attack requires access to the controller's API. It does not trigger through standard cluster monitoring or unrelated chaos experiments.

Is my cluster at risk if Chaos Mesh is only internal?

According to Halo Surface Signal, this software is typically used for internal testing in isolated environments, making public internet exposure very unlikely. However, if an attacker gains any foothold inside your network, they could attempt to reach the controller to exploit this flaw.

What should I do if I am running Chaos Mesh?

First, identify all deployments of Chaos Mesh within your environment to determine if they fall under the affected version range. Once you have an inventory, coordinate with your platform teams to assess how these instances are accessed and schedule updates to patch the controller.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.