GCVE - cpe:2.3:a:chaos-mesh:chaos_mesh:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:chaos-mesh:chaos_mesh:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Chaos Mesh (`55c79863-9962-514d-9124-144c6897f0b8`)
Product	Chaos Mesh (`072f7a85-f472-587c-9677-7acce9545061`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/chaos-mesh/chaos-mesh`	purl2cpe	2026-06-01 10:11:23.166606
`pkg:golang/github.com/chaos-mesh/chaos-mesh`	purl2cpe	2026-06-01 10:11:23.166609

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-59361`	vulnerable	2026-06-08 07:35:21.714398	OS command injection in Chaos Mesh via the cleanIptables mutation CRITICAL (9.8) The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster. Published: 2025-09-15T11:41:38.545Z Updated: 2025-09-15T20:35:31.294Z Open on db.gcve.eu Reference links https://github.com/chaos-mesh/chaos-mesh/pull/4702 https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-59360`	vulnerable	2026-06-08 07:35:21.714064	OS command injection in Chaos Mesh via the killProcesses mutation CRITICAL (9.8) The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster. Published: 2025-09-15T11:40:52.625Z Updated: 2025-09-15T20:34:59.504Z Open on db.gcve.eu Reference links https://github.com/chaos-mesh/chaos-mesh/pull/4702 https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-59359`	vulnerable	2026-06-08 07:35:21.713813	OS command injection in Chaos Mesh via the cleanTcs mutation CRITICAL (9.8) The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster. Published: 2025-09-15T11:40:04.866Z Updated: 2025-09-15T11:56:05.616Z Open on db.gcve.eu Reference links https://github.com/chaos-mesh/chaos-mesh/pull/4702 https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-59358`	vulnerable	2026-06-08 07:35:21.713490	Denial of Service via Unauthorized Access to Chaos Mesh debugging server HIGH (7.5) The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service. Published: 2025-09-15T11:34:30.616Z Updated: 2025-09-15T11:57:48.343Z Open on db.gcve.eu Reference links https://github.com/chaos-mesh/chaos-mesh/pull/4702 https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.