CVE-2025-59361

Published Sep 15, 2025

Last updated 9 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-59361 is an OS command injection vulnerability found in the cleanIptables mutation of Chaos Controller Manager. This vulnerability, in conjunction with CVE-2025-59358, allows unauthenticated attackers within a Kubernetes cluster to perform remote code execution across the cluster. Specifically, user-controlled inputs are directly incorporated into shell commands before execution. An attacker can exploit this to execute additional shell operations, like copying service-account tokens, potentially leading to privilege escalation and lateral movement within the cluster.

Description: The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
Source: reefs@jfrog.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

reefs@jfrog.com: CWE-78

Hype score: Not currently trending

References