48 matches found
chaos-mesh
Chaos Mesh is an open source, cloud-native Chaos Engineering platform for Kubernetes. It uses Kubernetes custom resources to define, orchestrate, and observe controlled fault injection against workloads, infrastructure, cloud services, and applications. Chaos Mesh is a Cloud Native Comp...
Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover
Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover A hands-on forensic walkthrough of CVE-2025-59359, a critical OS command injection flaw in Chaos-Mesh. Learn how attackers hijack Kubernetes clusters via GraphQL mutations, and how to detect, analyze, and report the breach using ELK...
GO-2026-5882 vulnerabilities
Vulnerabilities for packages: rancher-fleet, manifest-tool, trivy-operator-fips, kots, argo-cd-fips, consul-k8s-fips, rancher-agent, helm-set-status, gatekeeper, chartmuseum, helm-exporter-fips, kubescape-server-fips, gitlab-operator-fips, tigera-operator-fips, kube-arangodb-fips, k8ssandra-clien...
CVE-2026-47262 vulnerabilities
Vulnerabilities for packages: manifest-tool, trivy-operator-fips, kots, newrelic-infrastructure-agent, neuvector-scanner, datadog-agent, rancher-agent, consul-k8s-fips, k3s, syft, google-osconfig-agent, buildkitd-fips, helm-set-status, gatekeeper, chainctl, chartmuseum, helm-exporter-fips, ctop,...
CVE-2026-53488 vulnerabilities
Vulnerabilities for packages: manifest-tool, trivy-operator-fips, kots, newrelic-infrastructure-agent, neuvector-scanner, datadog-agent, rancher-agent, consul-k8s-fips, k3s, syft, google-osconfig-agent, buildkitd-fips, helm-set-status, gatekeeper, chainctl, chartmuseum, helm-exporter-fips, ctop,...
GHSA-XHF5-7WJV-PQXP vulnerabilities
Vulnerabilities for packages: manifest-tool, trivy-operator-fips, kots, newrelic-infrastructure-agent, neuvector-scanner, datadog-agent, rancher-agent, consul-k8s-fips, k3s, syft, google-osconfig-agent, buildkitd-fips, helm-set-status, gatekeeper, chainctl, chartmuseum, helm-exporter-fips, ctop,...
GHSA-JPCC-P29G-P8MQ vulnerabilities
Vulnerabilities for packages: manifest-tool, trivy-operator-fips, kots, newrelic-infrastructure-agent, neuvector-scanner, datadog-agent, rancher-agent, consul-k8s-fips, k3s, syft, google-osconfig-agent, buildkitd-fips, helm-set-status, gatekeeper, chainctl, chartmuseum, helm-exporter-fips, ctop,...
OS Command Injection
github.com/chaos-mesh/chaos-mesh is vulnerable to OS command Injection. The vulnerability is due to unsanitized input handling in the cleanTcs mutation due to user-controlled fields being passed to operating-system command execution without proper validation. An attacker can use this to perform...
OS Command Injection
github.com/chaos-mesh/chaos-mesh is vulnerable to OS command injection. The vulnerability is due to improper input validation in the cleanIptables mutation, which allows an unauthenticated in-cluster attacker to execute arbitrary commands and achieve remote code execution across the cluster...
Improper Authentication Exposure
github.com/chaos-mesh/chaos-mesh is vulnerable to improper authentication exposure. The vulnerability is due to the Chaos Controller Manager exposing an unauthenticated GraphQL debugging server to the entire Kubernetes cluster, which allows an attacker to kill arbitrary processes in any pod...
EUVD-2025-29175
Malicious code in bioql PyPI...
SUSE CVE-2025-59358
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...
GO-2025-3949 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh
Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3951 Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh
Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2025-3952 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh
Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3954 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh
Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
CVE-2025-59358
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...
Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover
Cybersecurity researchers have disclosed multiple critical security vulnerabilities in Chaos Mesh that, if successfully exploited, could lead to cluster takeover in Kubernetes environments. "Attackers need only minimal in-cluster network access to exploit these vulnerabilities, execute the...
GHSA-2GG8-85M5-8R2P Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...
CVE-2025-59358
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...