48 matches found
chaos-mesh
Chaos Mesh는 Kubernetes를 위한 오픈 소스, 클라우드 네이티브 카오스 엔지니어링Chaos Engineering 플랫폼입니다. Kubernetes 커스텀 리소스를 사용하여 워크로드, 인프라, 클라우드 서비스 및 애플리케이션에 대한 제어된 장애 주입을 정의, 오케스트레이션 및 관찰합니다. Chaos Mesh는 클라우드 네이티브 컴퓨팅 재단CNCF의 인큐베이팅 프로젝트입니다. 컨테이너로 패키징되고, 동적으로 스케줄링되며, 마이크로서비스 지향적인 기술의 발전을 함께 만들어 가고자 하는 조직이라면 CN...
Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover
Кластерный хаос: эксплуатация CVE-2025-59359 для захвата Kubernetes Практическое криминалистическое руководство по CVE-2025-59359 — критической уязвимости внедрения команд ОС в Chaos-Mesh. Узнайте, как злоумышленники захватывают кластеры Kubernetes через мутации GraphQL, а также как обнаруживать,...
GO-2026-5882 vulnerabilities
Vulnerabilities for packages: gatekeeper, headlamp-fips, xeol, envoy-gateway, kots, argocd-image-updater-fips, steampipe, kubescape, k8ssandra-client, kube-mgmt-fips, consul-k8s-fips, kyverno, helm-operator-fips, zarf-fips, kube-mgmt, cluster-api-helm-controller-fips, linkerd2, crossplane-fips,...
CVE-2026-47262 vulnerabilities
Vulnerabilities for packages: docker-cli-buildx-fips, spegel, gatekeeper, skaffold, headlamp-fips, xeol, envoy-gateway, docker-fips, kots, steampipe, kubescape, kube-mgmt-fips, consul-k8s-fips, docker-compose-fips, newrelic-infrastructure-agent-fips, google-osconfig-agent, helm-operator-fips,...
CVE-2026-53488 vulnerabilities
Vulnerabilities for packages: docker-cli-buildx-fips, spegel, gatekeeper, skaffold, headlamp-fips, xeol, envoy-gateway, docker-fips, kots, steampipe, kubescape, kube-mgmt-fips, consul-k8s-fips, docker-compose-fips, newrelic-infrastructure-agent-fips, google-osconfig-agent, helm-operator-fips,...
GHSA-XHF5-7WJV-PQXP vulnerabilities
Vulnerabilities for packages: docker-cli-buildx-fips, spegel, gatekeeper, skaffold, headlamp-fips, xeol, envoy-gateway, docker-fips, kots, steampipe, kubescape, kube-mgmt-fips, consul-k8s-fips, docker-compose-fips, newrelic-infrastructure-agent-fips, google-osconfig-agent, helm-operator-fips,...
GHSA-JPCC-P29G-P8MQ vulnerabilities
Vulnerabilities for packages: docker-cli-buildx-fips, spegel, gatekeeper, skaffold, headlamp-fips, xeol, envoy-gateway, docker-fips, kots, steampipe, kubescape, kube-mgmt-fips, consul-k8s-fips, docker-compose-fips, newrelic-infrastructure-agent-fips, google-osconfig-agent, helm-operator-fips,...
OS Command Injection
github.com/chaos-mesh/chaos-mesh is vulnerable to OS command Injection. The vulnerability is due to unsanitized input handling in the cleanTcs mutation due to user-controlled fields being passed to operating-system command execution without proper validation. An attacker can use this to perform...
OS Command Injection
github.com/chaos-mesh/chaos-mesh is vulnerable to OS command injection. The vulnerability is due to improper input validation in the cleanIptables mutation, which allows an unauthenticated in-cluster attacker to execute arbitrary commands and achieve remote code execution across the cluster...
Improper Authentication Exposure
github.com/chaos-mesh/chaos-mesh is vulnerable to improper authentication exposure. The vulnerability is due to the Chaos Controller Manager exposing an unauthenticated GraphQL debugging server to the entire Kubernetes cluster, which allows an attacker to kill arbitrary processes in any pod...
EUVD-2025-29175
Malicious code in bioql PyPI...
SUSE CVE-2025-59358
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...
GO-2025-3949 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh
Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3951 Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh
Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2025-3952 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh
Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3954 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh
Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
CVE-2025-59358
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...
Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover
Cybersecurity researchers have disclosed multiple critical security vulnerabilities in Chaos Mesh that, if successfully exploited, could lead to cluster takeover in Kubernetes environments. "Attackers need only minimal in-cluster network access to exploit these vulnerabilities, execute the...
GHSA-2GG8-85M5-8R2P Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...
CVE-2025-59358
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...