argo-cd 10.9.1 Helm chart

Name: argo-cd Helm chart 10.9.1: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

argo-cd-oci

Scored 15 Sept 2026

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

Version 10.9.1app version v3.5.3 76Artifact Hub

argo-cd 10.9.1 deploys 3 container images: quay.io/argoproj/argocd, ghcr.io/dexidp/dex and ecr-public.aws.com/docker/library/redis. Across them, 334 findings — 0 critical, 0 high. The highest contribution is GHSA-5cgq-3rg8-m6cv in golang.org/x/crypto v0.36.0, fixed in 0.52.0. Chart.yaml declares kubeVersion >=1.25.0-0; rendered for Kubernetes 1.25.0.

Radar Score

2,9890037297

334 findings over 3 of 3 images measured

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

3 images

Image	Tag	Vulnerabilities	Radar Score
quay.io/argoproj/argocd×8	v3.5.3	009178	1,455
ghcr.io/dexidp/dex	v2.45.1	0024111	1,366
ecr-public.aws.com/docker/library/redis	8.6.4-alpine	0048	168

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

231 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	UBUNTU-CVE-2026-45186	expat@2.7.4-1	no fix listed
Low	GHSA-37cx-329c-33x3	github.com/go-git/go-git/v5@v5.16.4	5.16.5
Low	UBUNTU-CVE-2026-89160	pcre2@10.46-1build1	no fix listed
Low	UBUNTU-CVE-2026-35359	rust-coreutils@0.8.0-0ubuntu3	no fix listed
Low	UBUNTU-CVE-2026-32776	expat@2.7.4-1	no fix listed
Low	UBUNTU-CVE-2026-35351	rust-coreutils@0.8.0-0ubuntu3	no fix listed
Low	UBUNTU-CVE-2026-41080	expat@2.7.4-1	no fix listed
Low	UBUNTU-CVE-2026-35354	rust-coreutils@0.8.0-0ubuntu3	no fix listed
Low	UBUNTU-CVE-2026-35357	rust-coreutils@0.8.0-0ubuntu3	no fix listed
Low	UBUNTU-CVE-2026-35370	rust-coreutils@0.8.0-0ubuntu3	no fix listed
Low	GO-2026-5024	golang.org/x/sys@v0.31.0	0.44.0
Low	GO-2026-6179	golang.org/x/mod@v0.32.0	0.40.0
Low	UBUNTU-CVE-2026-18477	tar@1.35+dfsg-4ubuntu0.4	no fix listed
Low	GO-2026-5410	github.com/slack-go/slack@v0.16.0	0.23.1
Low	GO-2026-5693	github.com/go-git/go-git/v5@v5.16.4	5.19.1
Low	GO-2026-5841	github.com/klauspost/compress@v1.18.0	1.18.7
Low	GO-2026-5932	golang.org/x/crypto@v0.36.0	no fix listed
Low	GO-2026-6061	google.golang.org/grpc@v1.81.1	1.82.1
Low	GO-2026-6278	github.com/gorilla/websocket@v1.5.1	1.5.3
Low	UBUNTU-CVE-2025-66382	expat@2.7.4-1	no fix listed
Low	GHSA-m7cr-m3pv-hgrp	github.com/go-git/go-git/v5@v5.16.4	5.19.1
Low	UBUNTU-CVE-2026-35371	rust-coreutils@0.8.0-0ubuntu3	no fix listed
Low	UBUNTU-CVE-2026-35373	rust-coreutils@0.8.0-0ubuntu3	no fix listed
Low	UBUNTU-CVE-2026-40228	systemd@259.5-0ubuntu3.4	no fix listed
Low	UBUNTU-CVE-2026-32778	expat@2.7.4-1	no fix listed
Low	UBUNTU-CVE-2026-35344	rust-coreutils@0.8.0-0ubuntu3	no fix listed
Low	UBUNTU-CVE-2026-35367	rust-coreutils@0.8.0-0ubuntu3	no fix listed
Low	UBUNTU-CVE-2026-35377	rust-coreutils@0.8.0-0ubuntu3	no fix listed
Low	GHSA-gm2x-2g9h-ccm8	github.com/go-git/go-git/v5@v5.16.4	5.17.1
Low	UBUNTU-CVE-2026-89162	pcre2@10.46-1build1	no fix listed
Low	UBUNTU-CVE-2026-89156	pcre2@10.46-1build1	no fix listed

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
10.9.1latest	—	v3.5.3	0037297	2,989
10.9.0	—	v3.5.2	0037325	3,219

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/argo-cd-oci/argo-cd.svg)](https://charts.stackradar.io/charts/argo-cd-oci/argo-cd)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.