chaos-mesh

Chaos Mesh es una plataforma de ingeniería del caos de código abierto y nativa de la nube para Kubernetes. Utiliza recursos personalizados de Kubernetes para definir, orquestar y observar la inyección controlada de fallos contra cargas de trabajo, infraestructura, servicios en la nube y...

Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover

Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover 一份关于 CVE-2025-59359（Chaos-Mesh 中的一个关键 OS 命令注入漏洞）的实操取证演练。了解攻击者如何通过 GraphQL 变异劫持 Kubernetes 集群，以及如何使用 ELK 检测、分析和报告此类入侵。 作者：Mark Mallia 执行摘要 CVE-2025-59359 暴露了 Chaos-Mesh 的 Controller Manager 中存在的一个关键 OS 命令注入缺陷。该漏洞允许攻击者在 Kubernetes Pod...

GO-2026-6597 vulnerabilities

Vulnerabilities for packages: manifest-tool, kube-mgmt-fips, kubescape, cloudbeat, kube-mgmt, packer, trivy-operator, helm-mapkubeapis, buildkitd-fips, kaniko, helm-set-status, datadog-agent-fips, docker-cli-buildx, chaos-mesh-fips, syft-fips, helm-push, redpanda-operator, crossplane-cli-fips,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: manifest-tool, kube-mgmt-fips, kubescape, oras-fips, cloudbeat, kube-mgmt, ocm-kubernetes-controller, trivy-operator, helm-mapkubeapis, linkerd2, helm-set-status, conftest, kyverno, chaos-mesh-fips, crossplane-fips, helm-push, kots, redpanda-operator, helm-operator,...

CVE-2026-47262 vulnerabilities

Vulnerabilities for packages: manifest-tool, kube-mgmt-fips, kubescape, cloudbeat, kube-mgmt, packer, trivy-operator, helm-mapkubeapis, buildkitd-fips, kaniko, linkerd2, helmfile, helm-set-status, datadog-agent-fips, docker-cli-buildx, chaos-mesh-fips, syft-fips, crossplane-fips, helm-push, kots,...

CVE-2026-53488 vulnerabilities

Vulnerabilities for packages: manifest-tool, kube-mgmt-fips, kubescape, cloudbeat, kube-mgmt, packer, trivy-operator, helm-mapkubeapis, buildkitd-fips, kaniko, linkerd2, helmfile, helm-set-status, datadog-agent-fips, docker-cli-buildx, chaos-mesh-fips, syft-fips, crossplane-fips, helm-push, kots,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: manifest-tool, kube-mgmt-fips, kubescape, cloudbeat, kube-mgmt, packer, trivy-operator, helm-mapkubeapis, buildkitd-fips, kaniko, linkerd2, helmfile, helm-set-status, datadog-agent-fips, docker-cli-buildx, chaos-mesh-fips, syft-fips, crossplane-fips, helm-push, kots,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: manifest-tool, kube-mgmt-fips, kubescape, cloudbeat, kube-mgmt, packer, trivy-operator, helm-mapkubeapis, buildkitd-fips, kaniko, linkerd2, helmfile, helm-set-status, datadog-agent-fips, docker-cli-buildx, chaos-mesh-fips, syft-fips, crossplane-fips, helm-push, kots,...

OS Command Injection

github.com/chaos-mesh/chaos-mesh is vulnerable to OS command Injection. The vulnerability is due to unsanitized input handling in the cleanTcs mutation due to user-controlled fields being passed to operating-system command execution without proper validation. An attacker can use this to perform...

OS Command Injection

github.com/chaos-mesh/chaos-mesh is vulnerable to OS command injection. The vulnerability is due to improper input validation in the cleanIptables mutation, which allows an unauthenticated in-cluster attacker to execute arbitrary commands and achieve remote code execution across the cluster...

Improper Authentication Exposure

github.com/chaos-mesh/chaos-mesh is vulnerable to improper authentication exposure. The vulnerability is due to the Chaos Controller Manager exposing an unauthenticated GraphQL debugging server to the entire Kubernetes cluster, which allows an attacker to kill arbitrary processes in any pod...

EUVD-2025-29175

Malicious code in bioql PyPI...

SUSE CVE-2025-59358

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...

GO-2025-3951 Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh

Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...

GO-2025-3954 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh

Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3952 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh

Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3949 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh

Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CVE-2025-59358

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...

Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover

Cybersecurity researchers have disclosed multiple critical security vulnerabilities in Chaos Mesh that, if successfully exploited, could lead to cluster takeover in Kubernetes environments. "Attackers need only minimal in-cluster network access to exploit these vulnerabilities, execute the...

Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover

Cybersecurity researchers have disclosed multiple critical security vulnerabilities in Chaos Mesh that, if successfully exploited, could lead to cluster takeover in Kubernetes environments. "Attackers need only minimal in-cluster network access to exploit these vulnerabilities, execute the...