temporal 0.54.2 Helm chart

Name: temporal Helm chart 0.54.2: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

castai

Scored 14 Sept 2026

Temporal is a distributed, scalable, durable, and highly available orchestration engine to execute asynchronous long-running business logic in a scalable and resilient way.

Version 0.54.2 1 year agoapp version 1.26.2 0Artifact Hub

temporal 0.54.2 deploys 14 container images: quay.io/prometheus/node-exporter, curlimages/curl, grafana/grafana, registry.k8s.io/kube-state-metrics/kube-state-metrics and 10 more. Across the 13 measured, 1,521 findings — 4 critical, 25 high — 2 on CISA KEV. The highest contribution is GHSA-mjmj-j48q-9wg2 in snakeyaml 1.11, fixed in 2.0.

Radar Score

16,1984252241,268

1,521 findings over 13 of 14 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

14 images

Image	Tag	Vulnerabilities	Radar Score
quay.io/prometheus/node-exporter	v1.8.1	00892	844
curlimages/curl	7.85.0	1362	405
grafana/grafana	11.0.0	0324154	1,901
registry.k8s.io/kube-state-metrics/kube-state-metrics	v2.12.0	01995	938
quay.io/prometheus/pushgateway	v1.8.0	011095	973
quay.io/prometheus-operator/prometheus-config-reloader	v0.74.0	009100	923
quay.io/prometheus/prometheus	v2.53.0	0111116	1,124
temporalio/admin-tools×11	1.26.2	2348183	2,717
library/busybox×5	latest	0000	0
library/cassandra×10	3.11.3	144071	1,926
temporalio/server×4	1.26.2	0327135	1,708
temporalio/ui	2.33.0	0522122	1,708
docker.elastic.co/elasticsearch/elasticsearch×2	7.17.3	—	unmeasured
quay.io/prometheus/alertmanager	v0.27.0	0110103	1,031

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

320 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	ALPINE-CVE-2025-69420	openssl@3.3.2-r0	3.3.6-r0
Low	PYSEC-2026-2132	click@8.1.7	8.3.3
Low	DLA-2976-1	gzip@1.6-5+b1	1.6-5+deb9u1
Low	DLA-2977-1	xz-utils@5.2.2-1.2+b1	5.2.2-1.2+deb9u1
Low	GHSA-vmq6-5m68-f53m	logback-classic@1.1.3	1.2.13
Low	GHSA-vmq6-5m68-f53m	logback-core@1.1.3	1.2.13
Low	ALPINE-CVE-2024-56406	perl@5.38.2-r0	5.38.3-r1
Low	GHSA-89gr-r52h-f8rx	golang.org/x/crypto@v0.31.0	0.52.0
Low	GHSA-6g7g-w4f8-9c9x	github.com/buger/jsonparser@v1.1.1	1.1.2
Low	DSA-4621-1	openjdk-8@8u181-b13-2~deb9u1	8u242-b08-1~deb9u1
Low	GHSA-jppx-rxg9-jmrx	golang.org/x/crypto@v0.31.0	0.52.0
Low	ALPINE-CVE-2026-6477	postgresql16@16.3-r0	16.14-r0
Low	DLA-2904-1	expat@2.2.0-2+deb9u1	2.2.0-2+deb9u4
Low	ALPINE-CVE-2024-9287	python3@3.12.6-r0	3.12.8-r0
Low	GHSA-mh63-6h87-95cp	github.com/golang-jwt/jwt/v4@v4.5.1	4.5.2
Low	GHSA-mh63-6h87-95cp	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2
Low	GHSA-mh63-6h87-95cp	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed
Low	ALPINE-CVE-2026-44168	mariadb@10.11.8-r0	10.11.17-r0
Low	DSA-4666-1	openldap@2.4.44+dfsg-5+deb9u2	2.4.44+dfsg-5+deb9u4
Low	DLA-2437-1	krb5@1.15-1+deb9u1	1.15-1+deb9u2
Low	ALPINE-CVE-2025-8715	postgresql16@16.3-r0	16.10-r0
Low	DSA-4485-1	openjdk-8@8u181-b13-2~deb9u1	8u222-b10-1~deb9u1
Low	DLA-2325-1	openjdk-8@8u181-b13-2~deb9u1	8u265-b01-0+deb9u1
Low	ALPINE-CVE-2026-2007	postgresql16@16.3-r0	16.12-r0
Low	GHSA-78h2-9frx-2jm8	github.com/go-jose/go-jose/v3@v3.0.3	3.0.5
Low	GHSA-78h2-9frx-2jm8	github.com/go-jose/go-jose/v4@v4.0.2	4.1.4
Low	GHSA-vp52-pcj8-j9qc	google.golang.org/grpc@v1.66.0	1.83.1
Low	DLA-2737-1	openjdk-8@8u181-b13-2~deb9u1	8u302-b08-1~deb9u1
Low	GHSA-p4r4-xvrq-gvmc	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	2.8.4
Low	DLA-2931-1	cyrus-sasl2@2.1.27~101-g0780600+dfsg-3	2.1.27~101-g0780600+dfsg-3+deb9u2
Low	GHSA-r277-6w6q-xmqw	github.com/getkin/kin-openapi@v0.120.0	0.144.0
Low	DLA-3006-1	openjdk-8@8u181-b13-2~deb9u1	8u332-ga-1~deb9u1
Low	GHSA-8wv5-x4w7-5gww	libthrift@0.9.2	0.24.0
Low	GHSA-8wv5-x4w7-5gww	github.com/apache/thrift@v0.17.0	0.24.0
Low	ALPINE-CVE-2026-6637	postgresql16@16.3-r0	16.14-r0
Low	GHSA-7pwc-h2j2-rjgj	libthrift@0.9.2	0.23.0
Low	DSA-4539-1	openssl@1.1.0j-1~deb9u1	1.1.0l-1~deb9u1
Low	DLA-2412-1	openjdk-8@8u181-b13-2~deb9u1	8u272-b10-0+deb9u1
Low	DSA-4548-1	openjdk-8@8u181-b13-2~deb9u1	8u232-b09-1~deb9u1
Low	DLA-2837-1	gmp@2:6.1.2+dfsg-1	2:6.1.2+dfsg-1+deb9u1
Low	DLA-2802-1	elfutils@0.168-1	0.168-1+deb9u1
Low	ALPINE-CVE-2023-0465	openssl@1.1.1q-r0	1.1.1t-r2
Low	DLA-2340-2	sqlite3@3.16.2-5+deb9u1	3.16.2-5+deb9u3
Low	ALPINE-CVE-2026-31789	openssl@3.3.2-r0	3.3.7-r0
Low	ALPINE-CVE-2025-69419	openssl@3.3.2-r0	3.3.6-r0
Low	DLA-2634-1	openjdk-8@8u181-b13-2~deb9u1	8u292-b10-0+deb9u1
Low	ALPINE-CVE-2026-6475	postgresql16@16.3-r0	16.14-r0
Low	GHSA-cgrx-mc8f-2prm	github.com/opencontainers/selinux@v1.11.0	1.13.0
Low	GHSA-wq9g-9vfc-cfq9	github.com/getkin/kin-openapi@v0.120.0	0.131.0
Low	DLA-2302-1	libjpeg-turbo@1:1.5.1-2	1:1.5.1-2+deb9u1

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.54.2latest	1 year ago	1.26.2	4252241,268	16,198

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/castai/temporal.svg)](https://charts.stackradar.io/charts/castai/temporal)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.