What is GHSA-2gg8-85m5-8r2p?

GHSA-2gg8-85m5-8r2p is a security advisory published by GitHub Security Advisories with High severity. Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function

Which CVE IDs does GHSA-2gg8-85m5-8r2p cover?

GHSA-2gg8-85m5-8r2p covers the following CVE IDs: CVE-2025-59358. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2gg8-85m5-8r2p?

GHSA-2gg8-85m5-8r2p has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-2gg8-85m5-8r2p?

GHSA-2gg8-85m5-8r2p affects 1 product, including: go/github.com/chaos-mesh/chaos-mesh:\u003c 2.7.3.

GHSA-2gg8-85m5-8r2pHighCVSS 7.5

Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function

Vendor

GitHub Security Advisories

Published

September 15, 2025

Last Modified

September 15, 2025

🔗 CVE IDs covered (1)

CVE-2025-59358 →

📋 Description

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.

🎯 Affected products1

go/github.com/chaos-mesh/chaos-mesh:< 2.7.3

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-59358
https://github.com/chaos-mesh/chaos-mesh/pull/4702
https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover
https://github.com/chaos-mesh/chaos-mesh/commit/67281c36f8068bf103149318cd0a466417213a28
https://github.com/advisories/GHSA-2gg8-85m5-8r2p