⬇ Download holy card: ·
Saint Chaotic Deputy, Who Loosed Chaos on the Cluster
Patron of chaos engineering tools, unauthenticated GraphQL servers, and Kubernetes clusters taken all at once.
Life
On 16 September 2025 Natan Nehorai of JFrog revealed Chaotic Deputy, four flaws in Chaos Mesh, the tool that injects controlled failures into Kubernetes clusters to test their resilience. The controller exposed, enabled by default, an unauthenticated GraphQL server to the whole cluster; three mutations suffered from command injection. From an ordinary pod one could run code anywhere and steal privileged tokens, up to control of the entire cluster.
Prayer
O Saint Chaotic Deputy, who sow failures by trade and disasters by default, let our chaos tools always ask who you are. Amen.
How to celebrate
Celebrated by upgrading Chaos Mesh to 2.7.3 or disabling the control server with enableCtrlServer=false.
Who sows failures as a test should reap at least one login.