PatchTheCVEchaos-mesh vulnerabilities
Recent CVEs affecting chaos-mesh products. 5 tracked.
chaos-mesh has 5 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-09-15. Highest priority: CVE-2025-59359 (score 69/100).
- CVE-2025-59361 CRITICAL 9.8 UPGRADE The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection
- CVE-2025-59360 CRITICAL 9.8 UPGRADE The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection
- CVE-2025-59359 CRITICAL 9.8 UPGRADE The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection
- CVE-2025-59358 HIGH 7.5 UPGRADE The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the en
- CVE-2024-36538 HIGH 8.8 DOWNGRADE Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by
FAQ
How do I fix chaos-mesh vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is chaos-mesh being exploited right now?
None of the tracked chaos-mesh CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which chaos-mesh CVE should I patch first?
CVE-2025-59359 currently ranks highest (69/100): The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection.