--- title: Chaos Mesh Critical GraphQL Flaws Enable RCE and Full... description: Critical security vulnerabilities discovered in Chaos Mesh, an open-source chaos engineering platform for Kubernetes, allow attackers with minimal cluster... canonical: https://daily.dev/posts/chaos-mesh-critical-graphql-flaws-enable-rce-and-full-kubernetes-cluster-takeover-fgsalqv77 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover | daily.dev og:description: Critical security vulnerabilities discovered in Chaos Mesh, an open-source chaos engineering platform for Kubernetes, allow attackers with minimal cluster... og:url: https://daily.dev/posts/chaos-mesh-critical-graphql-flaws-enable-rce-and-full-kubernetes-cluster-takeover-fgsalqv77 og:image: https://api.daily.dev/og/posts/fGSALQV77.png og:image:alt: Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover **[The Hacker News](https://daily.dev/sources/thn)** · 2 min read · 0 upvotes · 0 comments ## Summary Critical security vulnerabilities discovered in Chaos Mesh, an open-source chaos engineering platform for Kubernetes, allow attackers with minimal cluster network access to execute remote code and take over entire clusters. The flaws, dubbed 'Chaotic Deputy,' include an unauthenticated GraphQL debugging server and multiple command injection vulnerabilities with CVSS scores up to 9.8. All issues have been patched in version 2.7.3 released in August 2025. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#kubernetes](https://daily.dev/tags/kubernetes), [#vulnerability](https://daily.dev/tags/vulnerability), [#graphql](https://daily.dev/tags/graphql) [View this post on daily.dev](https://daily.dev/posts/chaos-mesh-critical-graphql-flaws-enable-rce-and-full-kubernetes-cluster-takeover-fgsalqv77) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover","url":"https://daily.dev/posts/chaos-mesh-critical-graphql-flaws-enable-rce-and-full-kubernetes-cluster-takeover-fgsalqv77","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/chaos-mesh-critical-graphql-flaws-enable-rce-and-full-kubernetes-cluster-takeover-fgsalqv77"},"datePublished":"2025-09-16T17:18:08.231Z","dateModified":"2025-09-16T21:41:32.351Z","description":"Critical security vulnerabilities discovered in Chaos Mesh, an open-source chaos engineering platform for Kubernetes, allow attackers with minimal cluster...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7e6e79e8fc1ad365a6034d8f183f0be0?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7e6e79e8fc1ad365a6034d8f183f0be0?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"The Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/thn","url":"https://daily.dev/sources/thn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/chaos-mesh-critical-graphql-flaws-enable-rce-and-full-kubernetes-cluster-takeover-fgsalqv77","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,kubernetes,vulnerability,graphql","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Hacker News","item":"https://daily.dev/sources/thn"},{"@type":"ListItem","position":3,"name":"Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover"}]} ```