Introduction
A critical flaw in Chaos Mesh lets unauthenticated in-cluster attackers achieve remote code execution across an entire Kubernetes cluster. The flaw is CVE-2025-59359, an OS command injection vulnerability in the cleanTcs mutation of the Chaos Controller Manager, and it is a severe risk for organizations that run chaos engineering in production.
About Chaos Mesh: Chaos Mesh is an open-source chaos engineering platform for Kubernetes. It is an incubating project of the Cloud Native Computing Foundation (CNCF), and organizations such as Tencent and Meituan have widely adopted it for resilience testing of distributed systems. Its privileged access to cluster resources and its integration with CI/CD pipelines make it a critical component in many cloud-native environments.
Technical Information
CVE-2025-59359 is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerability is in the cleanTcs mutation function, part of the Chaos Controller Manager component of Chaos Mesh. This function cleans up Linux traffic control (TC) configurations after network chaos experiments.
The root cause is improper input validation. The Controller Manager concatenates user-supplied parameters from chaos experiment specifications directly into the shell commands it executes. If these parameters are not sanitized, attackers can inject arbitrary shell commands. When the vulnerable mutation is triggered, the injected commands run with the privileges of the Controller Manager process, which typically has broad permissions in the Kubernetes environment.
The risk rises significantly when CVE-2025-59359 is chained with CVE-2025-59358, which allows unauthenticated access to the mutation. Together, the two let an attacker with only in-cluster network access achieve remote code execution across the cluster.
No public code snippets are available for this vulnerability. The references and vendor advisories confirm the technical details.
Affected Systems and Versions
- Product: Chaos Mesh (Chaos Controller Manager component)
- Vulnerable Function: cleanTcs mutation
- Affected versions: The public references do not list specific affected versions. Users should consult the official GitHub PR 4702 and vendor advisories for exact version information and upgrade guidance.
- Vulnerable configurations: Deployments where unauthenticated in-cluster users can reach the Chaos Controller Manager and where network chaos experiments are enabled.
Vendor Security History
Chaos Mesh's privileged operational model has led to earlier vulnerabilities involving privilege escalation and code execution, which the project has addressed. It has responded to critical issues with timely patches and public advisories. As a CNCF incubating project, Chaos Mesh is subject to community-driven security review, but its broad permissions and integration with cluster infrastructure continue to make it a high-value target for attackers.
