Chaos Controller Manager OS Command Injection Vulnerability Allowing Remote Code Execution
Vulnerability
A command injection vulnerability has been identified in the cleanTcs mutation of Chaos Controller Manager. This issue, when combined with another vulnerability (CVE-2025-59358), enables unauthenticated attackers within the cluster to execute remote code across the Kubernetes cluster.
Impact
Exploitation of this vulnerability allows for remote code execution on the affected Kubernetes cluster.
Remediation
Users are advised to update to Chaos Mesh version 2.7.3, where this vulnerability has been addressed.
Added: Sep 15, 2025, 12:25 PM
Updated: Sep 15, 2025, 10:01 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
10.0exploitability
3.3remediation
0.0relevance
0.5threat
0.0urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.