Multiple CVEs in the Chaos-Mesh platform have been discovered, including three critical vulnerabilities that allow in-cluster attackers to run arbitrary code on any pod, even in the default configuration. According to new research by JFrog Security Research, the flaws are tracked as CVE-2025-59358, CVE-2025-59360, CVE-2025-59361 and CVE-2025-59359. They affect the Chaos Controller Manager and expose a GraphQL debug server that accepts unauthenticated queries. JFrog's analysis, published on Tuesday, shows the controller exposes a ClusterIP GraphQL endpoint on port 10082 that, by default, does not enforce authentication for the /query path. Attackers with network access inside a cluster can call GraphQL mutations to trigger native fault injections, such as killing processes and modifying…