https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-59361.htmlhttps://patchthecve.com/cve/CVE-2025-59361.htmlWed, 17 Jun 2026 09:45:58 +0000CRITICAL 9.8: The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.https://patchthecve.com/cve/CVE-2025-59360.htmlhttps://patchthecve.com/cve/CVE-2025-59360.htmlWed, 17 Jun 2026 09:45:58 +0000CRITICAL 9.8: The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.https://patchthecve.com/cve/CVE-2025-59359.htmlhttps://patchthecve.com/cve/CVE-2025-59359.htmlWed, 17 Jun 2026 09:45:58 +0000CRITICAL 9.8: The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.https://patchthecve.com/cve/CVE-2025-59358.htmlhttps://patchthecve.com/cve/CVE-2025-59358.htmlWed, 17 Jun 2026 09:45:58 +0000HIGH 7.5: The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.https://patchthecve.com/cve/CVE-2024-36538.htmlhttps://patchthecve.com/cve/CVE-2024-36538.htmlWed, 17 Jun 2026 07:36:55 +0000HIGH 8.8: Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.