CVE-2025-59358

PoC —

CVSS 3.1

7.5 high

EPSS

<1%p54

Published

Sep 15, 2025 (Sep 15, 2025)

Modified

Jun 17, 2026

Description

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.

Vendors: chaos-mesh
Products: chaos mesh
Weakness: CWE-306
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news2 stories

Critical CVEs in Chaos-Mesh Enable In

Infosecurity MagazineSep 17, 16:00 UTC · Sep 17, 2025Vulnerability CVE-2025-59358 CVE-2025-59360 CVE-2025-59361+1 CVEs

Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover

The Hacker NewsSep 17, 06:14 UTC · Sep 17, 2025Vulnerability CVE-2025-59358 CVE-2025-59359 CVE-2025-59360+1 CVEs