CVE-2025-59358 — Denial of Service via Unauthorized Access to Chaos Mesh debugging server
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary pr…
Published: 2025-09-15 · CVSS: 7.5 · CVSS 3.1
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7