Cybersecurity researchers have uncovered a series of severe vulnerabilities in Chaos Mesh, a popular open-source platform used for chaos engineering in Kubernetes environments. These security flaws, collectively dubbed “Chaotic Deputy,” could allow attackers to completely compromise Kubernetes clusters with minimal network access.
## What is Chaos Mesh?
Chaos Mesh is a cloud-native chaos engineering platform that helps developers test system resilience by simulating various failures and abnormalities during the software development lifecycle. The platform can intentionally disrupt services, shut down pods, and interfere with network communications to identify potential weaknesses.
## The Vulnerabilities Discovered
JFrog security researchers identified four critical vulnerabilities that work together to create a devastating attack vector:
**CVE-2025-59358 (CVSS: 7.5)** – The platform’s GraphQL debugging server lacks proper authentication, exposing dangerous APIs across the entire Kubernetes cluster. This allows attackers to terminate processes in any pod, potentially causing cluster-wide service disruptions.
**CVE-2025-59359, CVE-2025-59360, CVE-2025-59361 (CVSS: 9.8 each)** – Three separate command injection vulnerabilities exist in the Chaos Controller Manager’s mutation functions (cleanTcs, killProcesses, and cleanIptables), enabling attackers to execute arbitrary operating system commands.
## How the Attack Works
An attacker with basic network access to a Kubernetes cluster can chain these vulnerabilities together to achieve remote code execution across the entire infrastructure. The attack exploits insufficient authentication in the Chaos Controller Manager’s GraphQL server, allowing unauthorized users to run malicious commands on the Chaos Daemon.
Once successful, attackers can:
– Steal privileged service account tokens
– Disrupt critical services
– Extract sensitive data
– Move laterally across the cluster
– Escalate privileges throughout the system
## Immediate Action Required
The vulnerabilities were responsibly disclosed in May 2025, and Chaos Mesh released a security patch in version 2.7.3 on August 21. Organizations using Chaos Mesh should:
1. **Update immediately** to version 2.7.3 or later
2. **Restrict network access** to Chaos Mesh daemon and API server if patching isn’t possible
3. **Avoid deploying** Chaos Mesh in unsecured environments
## The Bigger Picture
“Platforms such as Chaos Mesh give, by design, complete control of the Kubernetes cluster,” explained Shachar Menashe, VP of Security Research at JFrog. “This flexibility can become a critical risk when vulnerabilities like Chaotic Deputy are discovered.”
This incident highlights the inherent security challenges of chaos engineering tools, which require extensive system privileges to function effectively but can become dangerous attack vectors when compromised.
Organizations using chaos engineering platforms should implement strict security controls and regularly audit these powerful tools to prevent similar security incidents.