CVE-2025-59358: Chaos-Mesh Chaos Mesh

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.

Affected products

• Chaos-Mesh Chaos Mesh: before 2.7.3 (fixed in 2.7.3)

Published 2025-09-15. Last modified 2026-06-17.