Description (CNA)
The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected 0 through 2.7.2 |
CWE
CWE-78
References
- https://github.com/chaos-mesh/chaos-mesh/pull/4702
- https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover
ADP enrichment
No English description supplied.
No references supplied.