chaos-mesh

Chaos Mesh는 Kubernetes를 위한 오픈 소스, 클라우드 네이티브 카오스 엔지니어링Chaos Engineering 플랫폼입니다. Kubernetes 커스텀 리소스를 사용하여 워크로드, 인프라, 클라우드 서비스 및 애플리케이션에 대한 제어된 장애 주입을 정의, 오케스트레이션 및 관찰합니다. Chaos Mesh는 클라우드 네이티브 컴퓨팅 재단CNCF의 인큐베이팅 프로젝트입니다. 컨테이너로 패키징되고, 동적으로 스케줄링되며, 마이크로서비스 지향적인 기술의 발전을 함께 만들어 가고자 하는 조직이라면 CN...

GO-2026-6597 vulnerabilities

Vulnerabilities for packages: kgateway, kubescape-operator-fips, cg, chaos-mesh-fips, chartmuseum, k9s-fips, helm-exporter-fips, kube-mgmt, zarf, envoy-gateway, zarf-fips, trivy-fips, harvester-fips, neuvector, docker-cli-buildx-fips, helm-operator, buildkitd-fips, kubescape,...

Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover

Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover CVE-2025-59359の実践的なフォレンジックウォークスルーです。Chaos-Meshの重大なOSコマンドインジェクションの脆弱性について、攻撃者がGraphQLミューテーションを介してKubernetesクラスタを乗っ取る方法と、ELKを使用して侵害を検出・分析・報告する方法を学びます。 Mark Mallia 著 エグゼクティブサマリー...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: conftest-fips, kgateway, kubescape-operator-fips, chaos-mesh-fips, chartmuseum, k9s-fips, helm-exporter-fips, kube-mgmt, zarf, envoy-gateway, zarf-fips, trivy-fips, kyverno-notation-aws, kubescape, helm-operator, kyverno-fips, kyverno-notation-aws-fips,...

CVE-2026-47262 vulnerabilities

Vulnerabilities for packages: kgateway, kubescape-operator-fips, cg, chaos-mesh-fips, chartmuseum, k9s-fips, helm-exporter-fips, kube-mgmt, zarf, envoy-gateway, zarf-fips, trivy-fips, harvester-fips, neuvector, docker-cli-buildx-fips, helm-operator, buildkitd-fips, kubescape,...

CVE-2026-53488 vulnerabilities

Vulnerabilities for packages: kgateway, kubescape-operator-fips, cg, chaos-mesh-fips, chartmuseum, k9s-fips, helm-exporter-fips, kube-mgmt, zarf, envoy-gateway, zarf-fips, trivy-fips, harvester-fips, neuvector, docker-cli-buildx-fips, helm-operator, buildkitd-fips, kubescape,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: kgateway, kubescape-operator-fips, cg, chaos-mesh-fips, chartmuseum, k9s-fips, helm-exporter-fips, kube-mgmt, zarf, envoy-gateway, zarf-fips, trivy-fips, harvester-fips, neuvector, docker-cli-buildx-fips, helm-operator, buildkitd-fips, kubescape,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: kgateway, kubescape-operator-fips, cg, chaos-mesh-fips, chartmuseum, k9s-fips, helm-exporter-fips, kube-mgmt, zarf, envoy-gateway, zarf-fips, trivy-fips, harvester-fips, neuvector, docker-cli-buildx-fips, helm-operator, buildkitd-fips, kubescape,...

OS Command Injection

github.com/chaos-mesh/chaos-mesh is vulnerable to OS command Injection. The vulnerability is due to unsanitized input handling in the cleanTcs mutation due to user-controlled fields being passed to operating-system command execution without proper validation. An attacker can use this to perform...

OS Command Injection

github.com/chaos-mesh/chaos-mesh is vulnerable to OS command injection. The vulnerability is due to improper input validation in the cleanIptables mutation, which allows an unauthenticated in-cluster attacker to execute arbitrary commands and achieve remote code execution across the cluster...

Improper Authentication Exposure

github.com/chaos-mesh/chaos-mesh is vulnerable to improper authentication exposure. The vulnerability is due to the Chaos Controller Manager exposing an unauthenticated GraphQL debugging server to the entire Kubernetes cluster, which allows an attacker to kill arbitrary processes in any pod...

EUVD-2025-29175

Malicious code in bioql PyPI...

SUSE CVE-2025-59358

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...

GO-2025-3949 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh

Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3951 Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh

Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...

GO-2025-3954 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh

Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3952 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh

Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CVE-2025-59358

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...

Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover

Cybersecurity researchers have disclosed multiple critical security vulnerabilities in Chaos Mesh that, if successfully exploited, could lead to cluster takeover in Kubernetes environments. "Attackers need only minimal in-cluster network access to exploit these vulnerabilities, execute the...

Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover

Cybersecurity researchers have disclosed multiple critical security vulnerabilities in Chaos Mesh that, if successfully exploited, could lead to cluster takeover in Kubernetes environments. "Attackers need only minimal in-cluster network access to exploit these vulnerabilities, execute the...