Introduction
A single API request to a widely used chaos engineering tool can lead to remote code execution across an entire Kubernetes cluster. CVE-2025-59360 lets unauthenticated attackers run arbitrary operating system commands on every node managed by Chaos Mesh, a platform that reliability teams rely on in production environments. JFrog Security Research reported the vulnerability. It is rated critical, with a CVSS score of 9.8, and it is especially dangerous when paired with an authentication bypass (CVE-2025-59358).
About Chaos Mesh: Chaos Mesh is an open-source chaos engineering platform incubated by the Cloud Native Computing Foundation. Organizations worldwide use it to test the resilience of Kubernetes clusters through controlled fault injection. A global community maintains the project, which has thousands of users and active deployments in both testing and production environments. Its deep integration with Kubernetes and its privileged access to cluster nodes make it a high-impact component of cloud-native infrastructure.
Technical Information
CVE-2025-59360 is a command injection vulnerability in the killProcesses mutation of the Chaos Controller Manager component. This mutation lets users terminate processes on cluster nodes as part of chaos experiments. The mutation endpoint does not properly sanitize user-supplied input before inserting it into shell commands that the underlying operating system runs.
If an attacker sends crafted input that contains shell metacharacters or command separators, the vulnerable code path passes that input straight to the shell. The attacker's commands then run with the privileges of the Chaos Daemon, which typically runs as a privileged DaemonSet on every node in the cluster. From there, an attacker can:
- Execute arbitrary commands on every node
- Move laterally within the cluster
- Exfiltrate sensitive data
- Establish persistent access
If CVE-2025-59358 is also present, the attack needs no prior authentication, because that vulnerability allows unauthenticated access to the mutation endpoint. Together, the two vulnerabilities allow remote code execution across the cluster from any in-cluster location.
The referenced materials do not include public code snippets or the specific vulnerable lines of code. The vulnerability is confirmed and tracked as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), a common root cause of command injection in software that builds shell commands from user input.
Affected Systems and Versions
- Product: Chaos Mesh (Cloud Native Computing Foundation incubating project)
- Component: Chaos Controller Manager (killProcesses mutation)
- Deployment: Kubernetes clusters with Chaos Mesh installed
- Version information: The public sources list no specific affected version numbers as of the publication date. Treat every deployment that uses the killProcesses mutation in Chaos Controller Manager as potentially vulnerable until official advisories say otherwise.
- Vulnerable configuration: Any cluster where the Chaos Controller Manager is reachable from untrusted or unauthenticated network locations, especially if CVE-2025-59358 is also present.
Vendor Security History
Chaos Mesh has a published security policy and has responded to earlier vulnerabilities with public advisories and code updates. The project is actively maintained on GitHub and has a history of working with security researchers and fixing reported issues. Before 2025, no critical vulnerabilities had been reported in Chaos Mesh (see CVE Details). CVE-2025-59360 and the related issues show the risk that privileged Kubernetes tooling carries, and why that tooling needs ongoing security review.
