CVE-2025-59358
📋 TL;DR
The Chaos Controller Manager in Chaos Mesh exposes an unauthenticated GraphQL debugging server that allows attackers to kill arbitrary processes in any Kubernetes pod. This leads to cluster-wide denial of service by terminating critical system processes. All Kubernetes clusters running vulnerable versions of Chaos Mesh are affected.
💻 Affected Systems
- Chaos Mesh
📦 What is this software?
Chaos Mesh by Chaos Mesh
⚠️ Risk & Real-World Impact
Worst Case
Complete cluster-wide denial of service by killing critical system processes across all pods, potentially causing extended downtime and data loss.
Likely Case
Targeted disruption of specific applications or services by killing key processes, leading to partial service outages.
If Mitigated
Limited impact if network policies restrict access to the debugging server or if authentication is properly configured.
🎯 Exploit Status
Exploitation requires network access to the Chaos Controller Manager service within the Kubernetes cluster.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version including PR #4702
Vendor Advisory: https://github.com/chaos-mesh/chaos-mesh/pull/4702
Restart Required: Yes
Instructions:
1. Update Chaos Mesh to version containing PR #4702. 2. Restart Chaos Controller Manager pods. 3. Verify the GraphQL debugging server is no longer exposed without authentication.
🔧 Temporary Workarounds
Network Policy Restriction
linuxApply Kubernetes Network Policies to restrict access to the Chaos Controller Manager service.
kubectl apply -f network-policy.yaml
Service Account Restriction
linuxLimit service account permissions and use RBAC to control access to Chaos Mesh components.
kubectl apply -f rbac-restrictions.yaml
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Chaos Mesh components from other cluster resources.
- Deploy intrusion detection systems to monitor for process termination patterns across pods.
🔍 How to Verify
Check if Vulnerable:
Check if Chaos Controller Manager exposes port 2333 (GraphQL debugging server) without authentication: kubectl get svc -n chaos-mesh-testing | grep chaos-controller-managerCheck Version:
kubectl describe deployment chaos-controller-manager -n chaos-mesh-testing | grep ImageVerify Fix Applied:
Verify port 2333 is not exposed or requires authentication: kubectl describe svc chaos-controller-manager -n chaos-mesh-testing📡 Detection & Monitoring
Log Indicators:
- Unexpected process terminations across multiple pods
- GraphQL queries to Chaos Controller Manager debugging endpoint
Network Indicators:
- Traffic to port 2333 on Chaos Controller Manager from unauthorized sources
SIEM Query:
source="kubernetes" AND (event="process_terminated" OR port=2333)