chaos-mesh

Chaos Mesh — это облачная платформа Chaos Engineering с открытым исходным кодом для Kubernetes. Она использует пользовательские ресурсы Kubernetes для определения, оркестрации и наблюдения за контролируемой инъекцией сбоев в рабочие нагрузки, инфраструктуру, облачные сервисы и приложения...

GO-2026-6597 vulnerabilities

Vulnerabilities for packages: kgateway, kubescape-operator-fips, cg, chaos-mesh-fips, chartmuseum, k9s-fips, helm-exporter-fips, kube-mgmt, zarf, envoy-gateway, zarf-fips, trivy-fips, harvester-fips, neuvector, docker-cli-buildx-fips, helm-operator, buildkitd-fips, kubescape,...

Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover

Кластерный хаос: эксплуатация CVE-2025-59359 для захвата Kubernetes Практическое криминалистическое руководство по CVE-2025-59359 — критической уязвимости внедрения команд ОС в Chaos-Mesh. Узнайте, как злоумышленники захватывают кластеры Kubernetes через мутации GraphQL, а также как обнаруживать,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: conftest-fips, kgateway, kubescape-operator-fips, chaos-mesh-fips, chartmuseum, k9s-fips, helm-exporter-fips, kube-mgmt, zarf, envoy-gateway, zarf-fips, trivy-fips, kyverno-notation-aws, kubescape, helm-operator, kyverno-fips, kyverno-notation-aws-fips,...

CVE-2026-47262 vulnerabilities

Vulnerabilities for packages: kgateway, kubescape-operator-fips, cg, chaos-mesh-fips, chartmuseum, k9s-fips, helm-exporter-fips, kube-mgmt, zarf, envoy-gateway, zarf-fips, trivy-fips, harvester-fips, neuvector, docker-cli-buildx-fips, helm-operator, buildkitd-fips, kubescape,...

CVE-2026-53488 vulnerabilities

Vulnerabilities for packages: kgateway, kubescape-operator-fips, cg, chaos-mesh-fips, chartmuseum, k9s-fips, helm-exporter-fips, kube-mgmt, zarf, envoy-gateway, zarf-fips, trivy-fips, harvester-fips, neuvector, docker-cli-buildx-fips, helm-operator, buildkitd-fips, kubescape,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: kgateway, kubescape-operator-fips, cg, chaos-mesh-fips, chartmuseum, k9s-fips, helm-exporter-fips, kube-mgmt, zarf, envoy-gateway, zarf-fips, trivy-fips, harvester-fips, neuvector, docker-cli-buildx-fips, helm-operator, buildkitd-fips, kubescape,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: kgateway, kubescape-operator-fips, cg, chaos-mesh-fips, chartmuseum, k9s-fips, helm-exporter-fips, kube-mgmt, zarf, envoy-gateway, zarf-fips, trivy-fips, harvester-fips, neuvector, docker-cli-buildx-fips, helm-operator, buildkitd-fips, kubescape,...

OS Command Injection

github.com/chaos-mesh/chaos-mesh is vulnerable to OS command Injection. The vulnerability is due to unsanitized input handling in the cleanTcs mutation due to user-controlled fields being passed to operating-system command execution without proper validation. An attacker can use this to perform...

OS Command Injection

github.com/chaos-mesh/chaos-mesh is vulnerable to OS command injection. The vulnerability is due to improper input validation in the cleanIptables mutation, which allows an unauthenticated in-cluster attacker to execute arbitrary commands and achieve remote code execution across the cluster...

Improper Authentication Exposure

github.com/chaos-mesh/chaos-mesh is vulnerable to improper authentication exposure. The vulnerability is due to the Chaos Controller Manager exposing an unauthenticated GraphQL debugging server to the entire Kubernetes cluster, which allows an attacker to kill arbitrary processes in any pod...

EUVD-2025-29175

Malicious code in bioql PyPI...

SUSE CVE-2025-59358

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...

GO-2025-3951 Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh

Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...

GO-2025-3949 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh

Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3954 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh

Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3952 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh

Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CVE-2025-59358

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...

Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover

Cybersecurity researchers have disclosed multiple critical security vulnerabilities in Chaos Mesh that, if successfully exploited, could lead to cluster takeover in Kubernetes environments. "Attackers need only minimal in-cluster network access to exploit these vulnerabilities, execute the...

Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover

Cybersecurity researchers have disclosed multiple critical security vulnerabilities in Chaos Mesh that, if successfully exploited, could lead to cluster takeover in Kubernetes environments. "Attackers need only minimal in-cluster network access to exploit these vulnerabilities, execute the...