External risk intelligence

Chaos Mesh OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-59361

Chaos Mesh is a tool designed for chaos engineering and testing within Kubernetes clusters. It is an internal infrastructure component typically deployed in isolated environments for cluster management and testing, not as a public-facing service, web application, or edge gateway.

OS Command Injection

Chaos Mesh Chaos Mesh

before 2.7.3

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the Chaos Controller Manager, a component used for chaos engineering within Kubernetes clusters. The issue, when combined with another vulnerability, could allow unauthorized attackers within the cluster to execute remote code, potentially leading to a complete cluster takeover. The main concern is to confirm if this technology is in use and if so, assess the exposure.

Unauthenticated attackers could execute code remotely.
Critical for cluster security if Chaos Mesh is deployed.
Confirm relevance and assess your exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by targeting the Chaos Controller Manager within a Kubernetes cluster. Because the vulnerability doesn't require authentication and is network-accessible, an attacker could potentially reach the `cleanIptables` mutation. When this mutation is triggered, it could allow for remote code execution, enabling an attacker to take control of the entire cluster, especially when chained with another vulnerability.

No authentication needed.
Triggered via `cleanIptables` mutation.
Risk of cluster-wide code execution.

Live Threat

Current exploitation, exposure, and threat context

The cleanIptables mutation in Chaos Controller Manager could allow unauthenticated attackers within a Kubernetes cluster to execute arbitrary commands remotely. This could affect the integrity and availability of services running within the cluster, as well as any data processed by those services.

Cluster services and data at risk.
Remote command execution in-cluster.
Compromised cluster operations and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Ownership of this critical vulnerability likely falls to the platform or infrastructure teams managing Kubernetes, in coordination with the security team responsible for cluster integrity. The initial practical step is to identify all instances of the affected Chaos Mesh component within the cluster, assess their exposure and business criticality, and confirm the accountable owner for remediation. This will allow for a risk-based approach to planning the necessary actions.

Platform/Infrastructure owners.
Verify Chaos Mesh deployment reachability.
Plan coordinated cluster-wide remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chaos Mesh and what is it used for?

Chaos Mesh is an open-source tool for chaos engineering in Kubernetes environments. Platform engineers use it to inject faults—such as network delays or pod failures—into their clusters to test system resilience and reliability. It operates by managing resources within the Kubernetes cluster, helping teams understand how their services recover from real-world infrastructure issues.

What does OS command injection mean for CVE-2025-59361?

This vulnerability falls under the Improper Neutralization of Special Elements used in an OS Command (CWE-78) weakness class. It means the Chaos Controller Manager fails to properly filter input, allowing an attacker to insert and execute their own operating system commands. In this context, it grants the attacker the ability to run unauthorized code directly on the underlying systems where the manager is active.

How is the cleanIptables flaw triggered?

The vulnerability is triggered when the Chaos Controller Manager processes a specific mutation request involving the cleanIptables function. This bug does not trigger during standard, non-malicious operations performed by authorized users. It specifically requires an attacker to send a specially crafted request that forces the system to interpret and run unintended commands.

Is my cluster at risk from this CVE?

According to Halo Surface Signal, this software is typically used as an internal infrastructure component, making it unlikely to be a public-facing service. However, because the vulnerability allows unauthenticated access within the cluster, the risk is significant if an attacker gains any foothold inside your network. You should care if you run Chaos Mesh, as a compromised internal service could use this to escalate control.

What should I do if I use Chaos Mesh?

Your first step is to perform an inventory to locate all deployed instances of Chaos Mesh across your Kubernetes environments. Once identified, work with your infrastructure or platform teams to prioritize these assets based on their criticality. Plan for a coordinated update, as applying the necessary vendor patches is the standard way to resolve the underlying command injection weakness.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.