Introduction
A critical flaw in Chaos Mesh, a core chaos engineering tool, makes remote code execution across an entire Kubernetes cluster possible for unauthenticated attackers with in-cluster access. CVE-2025-59361 affects Chaos Mesh, an open-source chaos engineering platform for Kubernetes. The Cloud Native Computing Foundation incubates the project, and it is widely used for resilience testing in Kubernetes environments.
A community led by PingCAP maintains Chaos Mesh, and organizations around the world use it to test the resilience of distributed systems.
Technical information
CVE-2025-59361 is an OS command injection vulnerability (CWE-78) in the cleanIptables mutation of the Chaos Controller Manager component in Chaos Mesh. The mutation cleans up iptables rules after network chaos experiments, and it does not properly validate its input while doing so. An attacker who can influence that input can inject arbitrary shell commands, which run with the privileges of the Controller Manager.
The attack is especially severe when chained with CVE-2025-59358, which provides the initial access vector. Together, the two flaws let unauthenticated attackers with in-cluster access achieve remote code execution across the cluster.
Key technical points:
- The vulnerability is triggered during the cleanup phase of network chaos experiments, when the vulnerable function cleans up iptables rules.
- The function does not properly sanitize its input, so an attacker can inject shell metacharacters and arbitrary commands.
- Chaos Mesh components such as the Chaos Daemon often run with elevated privileges, which increases the potential impact.
The available sources include no public code snippets or direct code references. The vulnerability is discussed in GitHub pull request #4702.
Affected systems and versions
- Product: Chaos Mesh
- Component: Chaos Controller Manager (cleanIptables mutation)
- Version information: The public sources do not list specific affected versions. All deployments that use the vulnerable cleanIptables mutation are potentially affected, especially those not updated after September 15, 2025.
- Vulnerable configurations: Any Kubernetes cluster running Chaos Mesh with network chaos functionality enabled and default permissions for the Chaos Daemon or Controller Manager.
Vendor security history
- Chaos Mesh has a limited history of publicly disclosed vulnerabilities (CVE Details).
- A community led by PingCAP maintains the project, and CNCF incubates it.
- The project handles security fixes through GitHub pull requests, and it responded promptly to this vulnerability (PR #4702).
