CVE-2024-36538: Chaos Mesh Privilege Escalation Flaw

CVE-2024-36538 Overview

CVE-2024-36538 is an insecure permissions vulnerability in Chaos Mesh v2.6.3, an open-source chaos engineering platform for Kubernetes. The flaw allows authenticated attackers with low privileges to access the service account's token, enabling access to sensitive data and privilege escalation within the cluster. The weakness is categorized as [CWE-278] Insecure Preserved Inherited Permissions. The vulnerability is exploitable over the network and produces high impact to confidentiality, integrity, and availability.

Critical Impact
An attacker who obtains the Chaos Mesh service account token can escalate privileges within the Kubernetes cluster and access sensitive workload data.

Affected Products

Chaos Mesh v2.6.3
Kubernetes deployments running the affected Chaos Mesh release
Environments where the Chaos Mesh service account has broad cluster permissions

Discovery Timeline

2024-07-24 - CVE-2024-36538 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36538

Vulnerability Analysis

Chaos Mesh v2.6.3 exposes overly permissive access controls around its Kubernetes service account. An authenticated attacker with limited access can retrieve the service account's token and reuse it to authenticate to the Kubernetes API. Because Chaos Mesh requires broad privileges to inject faults across pods and nodes, the recovered token typically grants far more capability than the attacker's original identity. The result is horizontal and vertical privilege escalation across workloads managed by the cluster.

Root Cause

The underlying issue is [CWE-278], Insecure Preserved Inherited Permissions. Chaos Mesh grants its service account cluster-wide capabilities, and the token backing that account is not sufficiently isolated from lower-privileged callers. Any principal that can reach the exposed interface inherits the elevated permissions attached to the token.

Attack Vector

Exploitation is remote and requires low privileges with no user interaction. An attacker with access to the Chaos Mesh control plane retrieves the service account token from the accessible interface. The attacker then authenticates to the Kubernetes API using the stolen token and performs privileged actions such as reading secrets, executing into pods, or creating resources. A publicly available exploit demonstrating the sequence is referenced on GitHub Gist.

// No verified exploitation code is reproduced here.
// See the referenced GitHub Gist for the public proof-of-concept.

Detection Methods for CVE-2024-36538

Indicators of Compromise

Unexpected Kubernetes API requests authenticated with the Chaos Mesh service account token from unusual source pods or IP addresses.
Creation of new PodChaos, NetworkChaos, or other Chaos Mesh custom resources by identities that do not normally interact with the platform.
Access to Kubernetes Secrets, ConfigMaps, or exec subresources originating from the Chaos Mesh service account outside of scheduled experiments.

Detection Strategies

Audit Kubernetes API server logs for calls made with the Chaos Mesh service account and correlate against the expected source pods and namespaces.
Alert on service-account token usage patterns that deviate from baseline Chaos Mesh operator behavior.
Inventory Chaos Mesh deployments across clusters and confirm the running version is greater than v2.6.3.

Monitoring Recommendations

Enable and forward Kubernetes audit logs to a centralized analytics platform for cross-cluster correlation.
Monitor RoleBinding and ClusterRoleBinding modifications that reference the Chaos Mesh service account.
Track egress from Chaos Mesh controller pods for anomalous API destinations or credential exfiltration attempts.

How to Mitigate CVE-2024-36538

Immediate Actions Required

Upgrade Chaos Mesh to a version later than v2.6.3 that addresses the insecure permissions issue.
Restrict network access to the Chaos Mesh dashboard and API to trusted administrator networks only.
Rotate the Chaos Mesh service account token and any credentials that may have been exposed.
Review Kubernetes RBAC and reduce the Chaos Mesh service account permissions to the minimum required.

Patch Information

No vendor advisory URL is available in the enriched data. Consult the Chaos Mesh project release notes and upgrade beyond v2.6.3. Additional technical context is available on GitHub Gist.

Workarounds

Isolate the Chaos Mesh namespace using Kubernetes NetworkPolicies to restrict which pods can reach its services.
Disable the Chaos Mesh dashboard in production clusters if it is not actively used.
Enforce authentication and authorization on the Chaos Mesh dashboard and restrict administrative access to named identities.

bash

# Configuration example: restrict access to Chaos Mesh namespace
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: chaos-mesh-restrict
  namespace: chaos-mesh
spec:
  podSelector: {}
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              role: admin
EOF