Chaos Controller Manager OS Command Injection Vulnerability Allowing Remote Code Execution
Vulnerability
A command injection vulnerability has been identified in the Chaos Controller Manager, specifically within the cleanIptables mutation. This vulnerability allows unauthenticated attackers within the cluster to execute remote code across the cluster. It is related to another vulnerability, CVE-2025-59358.
Impact
Exploitation of this vulnerability could lead to unauthorized remote code execution on the affected cluster.
Remediation
Users are advised to update to the latest version of Chaos Mesh, where this vulnerability has been addressed.
Added: Sep 15, 2025, 12:17 PM
Updated: Sep 15, 2025, 9:59 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
10.0exploitability
7.4remediation
0.0relevance
0.5threat
0.0urgency
2.9incentive
5.8Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.