Chaos Mesh Fixes CVEs in Cluster Chaos Code

Chaos Mesh, a popular chaos engineering platform for Kubernetes, recently addressed multiple critical vulnerabilities in its cluster chaos code. These CVEs could allow attackers to disrupt cluster operations or escalate privileges, posing significant risks to cloud-native environments. The security patches released by the Chaos Mesh team mitigate these threats by fixing flaws in the way chaos experiments are executed and managed within Kubernetes clusters. This update underscores the importance of securing chaos engineering tools, which are increasingly used to test system resilience but can introduce new attack surfaces if not properly maintained. Organizations leveraging Chaos Mesh should promptly apply these updates to safeguard their infrastructure against potential exploitation. The incident highlights the evolving threat landscape in cloud-native security and the need for continuous vulnerability management in DevOps pipelines. Cybersecurity professionals must stay vigilant about vulnerabilities in emerging technologies like chaos engineering to prevent disruptions and maintain robust defense postures.

This Cyber News was published on www.infosecurity-magazine.com. Publication date: Wed, 17 Sep 2025 15:05:24 +0000


Cyber News related to Chaos Mesh Fixes CVEs in Cluster Chaos Code

When a Data Mesh Doesn't Make Sense - The data mesh is a thoughtful decentralized approach that facilitates the creation of domain-driven, self-service data products. Data mesh-including data mesh governance-requires the right mix of process, tooling, and internal resources to be ...
1 year ago Feeds.dzone.com
Chaos Mesh Fixes CVEs in Cluster Chaos Code - Chaos Mesh, a popular chaos engineering platform for Kubernetes, recently addressed multiple critical vulnerabilities in its cluster chaos code. These CVEs could allow attackers to disrupt cluster operations or escalate privileges, posing significant ...
3 weeks ago Infosecurity-magazine.com CVE-2023-XXXX CVE-2023-YYYY
CVE-2022-49290 - In the Linux kernel, the following vulnerability has been resolved: ...
7 months ago
Chaos Mesh Vulnerabilities: Critical Security Flaws Exposed - Chaos Mesh, a popular cloud-native chaos engineering platform, has recently been found to contain several critical vulnerabilities that could potentially allow attackers to execute arbitrary code, escalate privileges, or cause denial of service. ...
3 weeks ago Cybersecuritynews.com CVE-2024-12345 CVE-2024-12346
Dual Privilege Escalation Chain: Exploiting Monitoring and Service Mesh Configurations and Privileges in GKE to Gain Unauthorized Access in Kubernetes - While each issue might not result in significant damage on its own, when combined they create an opportunity for an attacker who already has access to a Kubernetes cluster to escalate their privileges. If an attacker has the ability to execute in the ...
1 year ago Unit42.paloaltonetworks.com
Key Group uses leaked builders of ransomware and wipers | Securelist - The first discovered sample of Key Group, the Xorist ransomware, established persistence in the system by changing file extension associations. The .huis_bn extension added to encrypted files in the early versions of Key Group samples, Xorist and ...
1 year ago Securelist.com
CVE-2025-38512 - In the Linux kernel, the following vulnerability has been resolved: ...
1 month ago
Chaos Mesh: Critical GraphQL Flaws Expose Kubernetes Clusters to Remote Attacks - Chaos Mesh, a popular open-source chaos engineering platform for Kubernetes, has been found to contain critical GraphQL vulnerabilities that could allow remote attackers to compromise Kubernetes clusters. These security flaws expose sensitive cluster ...
3 weeks ago Thehackernews.com CVE-2025-12345 CVE-2025-12346
Coming Soon to Wi-SUN Field Area Network: Versatility to connect sensors with low power and high throughput capabilities - The Catalyst IR8140 Heavy Duty Series Router will be Cisco's first router to support new Capabilities for FAN 1.1. In 2019 the Wi-SUN Alliance introduced the first certified products implementing Field Area Network 1.0, which is a secure, ...
1 year ago Feedpress.me
Critical Bugs in Chaos Mesh Could Lead to Cluster Takeover - Chaos Mesh, an open-source chaos engineering platform for Kubernetes, has been found to contain critical security vulnerabilities that could allow attackers to take over entire clusters. These bugs expose Kubernetes clusters to severe risks, ...
3 weeks ago Darkreading.com CVE-2023-28432 CVE-2023-28433
CVE-2024-27410 - In the Linux kernel, the following vulnerability has been resolved: ...
1 year ago
CVE-2023-32191 - When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may ...
1 year ago Tenable.com
CVE-2025-26521 - When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin' user of the caller account are used to create the secret config in the CKS-based Kubernetes cluster. ...
3 months ago
CVE-2023-28114 - `cilium-cli` is the command line interface to install, manage, and troubleshoot Kubernetes clusters running Cilium. Prior to version 0.13.2,`cilium-cli`, when used to configure cluster mesh functionality, can remove the enforcement of user ...
2 years ago
Kubernetes DaemonSet: Monitoring in Kubernetes - That's why it makes sense to collect logs from every node and send them to some sort of central location outside the Kubernetes cluster for persistence and later analysis. A DaemonSet in Kubernetes is a specific kind of workload controller that ...
1 year ago Feeds.dzone.com
Multiple Flaws in Google Kubernetes Engine - Google Kubernetes Engine has been detected with two flaws that a threat actor can utilize to create significant damage in case the threat actor already has access inside the Kubernetes cluster. The first issue was associated with FluentBit with ...
1 year ago Gbhackers.com
FBI seizes $2.4M in Bitcoin from new Chaos ransomware operation - "The seized funds were traced to a cryptocurrency address allegedly associated with a member of the Chaos ransomware group, known as 'Hors,' who has been tied to ransomware attacks against victims here in the Northern District of Texas and ...
2 months ago Bleepingcomputer.com Blacksuit
CVE-2025-38692 - In the Linux kernel, the following vulnerability has been resolved: ...
1 month ago
CVE-2022-31098 - Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive ...
3 years ago
Microsoft: Windows Server KB5062557 causes cluster, VM issues - "After installing the July Windows security update (the Originating KBs listed above), the Cluster Service on Windows Server 2019 might repeatedly stop and restart, causing nodes to fail to rejoin the cluster or enter quarantine states, virtual ...
2 months ago Bleepingcomputer.com
How software engineering will evolve in 2024 - From artificial intelligence and digital twin technologies, to platform engineering rooted in devops principles, to chaos engineering techniques that enhance resilience, to the expanded use of internal developer portals that boost productivity, ...
1 year ago Infoworld.com
ChatGPT side-channel attack has easy fix: token obfuscation The Register - In brief Almost as quickly as a paper came out last week revealing an AI side-channel vulnerability, Cloudflare researchers have figured out how to solve it: just obscure your token size. The paper [PDF], from researchers at the Offensive AI ...
1 year ago Go.theregister.com
CVE-2018-2822 - Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: Cluster Geo). The supported version that is affected is 4.3. Easily exploitable vulnerability allows low privileged attacker with logon to the ...
6 years ago
CVE-2023-30622 - Clusternet is a general-purpose system for controlling Kubernetes clusters across different environments. An issue in clusternet prior to version 0.15.2 can be leveraged to lead to a cluster-level privilege escalation. The clusternet has a deployment ...
2 years ago
CVE-2024-22032 - This issue is only relevant to clusters provisioned using RKE1 with secrets encryption configuration enabled. ...
1 year ago Tenable.com

Cyber Trends (last 7 days)