GitHub Advisoryadvisory · Go

GHSA-2gg8-85m5-8r2p Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function

HIGH Published 2025-09-15 Modified 2025-09-15 Official page ↗
Aliases
CVE-2025-59358
Ecosystem
Go
Packages
github.com/chaos-mesh/chaos-mesh
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-306
Reviewed
2025-09-15

Affected packages

• Go github.com/chaos-mesh/chaos-mesh: < 2.7.3 → fixed in 2.7.3

Description

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.

Related

Alias · CVE (1)

  • CVE-2025-59358 The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster,… vulnerability

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References