CVE-2025-59358: Denial of Service via Unauthorized Access to Chaos Mesh debugging server
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59358?
CVE-2025-59358 has a high severity rating due to its potential for causing cluster-wide denial of service in Kubernetes environments.
How do I fix CVE-2025-59358?
To fix CVE-2025-59358, it is recommended to disable the GraphQL debugging server or secure it with proper authentication measures.
What impact does CVE-2025-59358 have on Kubernetes?
CVE-2025-59358 allows unauthorized access to kill arbitrary processes in any Kubernetes pod, posing significant risks to cluster stability.
Is CVE-2025-59358 specific to a certain version of Chaos Mesh?
CVE-2025-59358 affects the Chaos Controller Manager component of the Chaos Mesh software, regardless of version, if the debugging server is exposed.
How can I mitigate the risks of CVE-2025-59358?
Mitigation strategies for CVE-2025-59358 include restricting access to the debugging server and implementing network policies to limit exposure.