prometheus-operator 6.4.0 Helm chart

Name: prometheus-operator Helm chart 6.4.0: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

cloudnativeapp

Scored 14 Sept 2026

Provides easy monitoring definitions for Kubernetes services, and deployment and management of Prometheus instances.

Version 6.4.0 5 years agoapp version 0.31.1 0Artifact Hub

prometheus-operator 6.4.0 deploys 7 container images: registry.cn-hangzhou.aliyuncs.com/kubeapps/quay-node-exporter, kiwigrid/k8s-sidecar, grafana/grafana, registry.cn-hangzhou.aliyuncs.com/kubeapps/quay-kube-state-metrics and 3 more. Across the 4 measured, 180 findings — 1 critical, 5 high — 1 on CISA KEV. The highest contribution is ALPINE-CVE-2019-9513 in nghttp2 1.32.0-r0, fixed in 1.39.2-r0.

Radar Score

2,9541571103

180 findings over 4 of 7 images measured

KEV confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

7 images

Image	Tag	Vulnerabilities	Radar Score
registry.cn-hangzhou.aliyuncs.com/kubeapps/quay-node-exporter	v0.18.0	—	unmeasured
kiwigrid/k8s-sidecar×2	0.0.18	013858	1,402
grafana/grafana	6.2.5	012738	1,102
registry.cn-hangzhou.aliyuncs.com/kubeapps/quay-kube-state-metrics	v1.7.2	—	unmeasured
registry.cn-hangzhou.aliyuncs.com/kubeapps/quay-prometheus-operator	v0.31.1	—	unmeasured
squareup/ghostunnel	v1.4.1	1310	259
jettech/kube-webhook-certgen×2	v1.0.0	0057	191

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

135 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	PYSEC-2026-3721	pip@19.1.1	26.2
Low	DLA-2295-1	curl@7.52.1-5+deb9u9	7.52.1-5+deb9u11
Low	GHSA-mq26-g339-26xf	pip@19.1.1	23.3
Low	DSA-4535-1	e2fsprogs@1.43.4-2	1.43.4-2+deb9u1
Low	GHSA-pq67-6m6q-mj2v	urllib3@1.25.3	2.5.0
Low	DLA-2290-1	e2fsprogs@1.43.4-2	1.43.4-2+deb9u2
Low	GHSA-65pc-fj4g-8rjx	idna@2.8	3.15
Low	GHSA-9wx4-h78v-vm56	requests@2.21.0	2.32.0
Low	PYSEC-2025-183	pyjwt@1.7.1	no fix listed
Low	GHSA-qccp-gfcp-xxvc	urllib3@1.25.3	2.7.0
Low	GHSA-537c-gmf6-5ccf	cryptography@2.7	48.0.1
Low	GHSA-g4mx-q9vg-27p4	urllib3@1.25.3	1.26.18
Low	DLA-2830-1	tar@1.29b-1.1	1.29b-1.1+deb9u1
Low	PYSEC-2026-2275	requests@2.21.0	2.33.0
Low	DLA-3063-1	systemd@232-25+deb9u11	232-25+deb9u14
Low	DLA-2487-1	apt@1.4.9	1.4.11
Low	GHSA-m959-cc7f-wv43	cryptography@2.7	46.0.6
Low	GHSA-jp4c-xjxw-mgf9	pip@19.1.1	26.1
Low	PYSEC-2026-177	pyjwt@1.7.1	2.13.0
Low	PYSEC-2026-175	pyjwt@1.7.1	2.13.0
Low	GHSA-58qw-9mgm-455v	pip@19.1.1	26.1
Low	DLA-2424-1	tzdata@2019a-0+deb9u1	2020d-0+deb9u1
Low	DLA-2509-1	tzdata@2019a-0+deb9u1	2020e-0+deb9u1
Low	DLA-2542-1	tzdata@2019a-0+deb9u1	2021a-0+deb9u1
Low	DLA-2593-1	ca-certificates@20161130+nmu1+deb9u1	20200601~deb9u2
Low	DLA-2759-1	gnutls28@3.5.8-5+deb9u4	3.5.8-5+deb9u6
Low	DLA-2761-1	openssl1.0@1.0.2r-1~deb9u1	1.0.2u-1~deb9u5
Low	DLA-2797-1	tzdata@2019a-0+deb9u1	2021a-0+deb9u2
Low	DLA-2948-1	debian-archive-keyring@2017.5	2017.5+deb9u2
Low	DLA-2963-1	tzdata@2019a-0+deb9u1	2021a-0+deb9u3
Low	DLA-3051-1	tzdata@2019a-0+deb9u1	2021a-0+deb9u4
Low	GHSA-6vgw-5pg2-w6jp	pip@19.1.1	26.0
Low	GHSA-5cpq-8wj7-hf2v	cryptography@2.7	41.0.0
Low	GHSA-jm77-qphf-c4w8	cryptography@2.7	41.0.3
Low	GHSA-v8gr-m533-ghj9	cryptography@2.7	41.0.4

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
6.4.0latest	5 years ago	0.31.1	1571103	2,954

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/cloudnativeapp/prometheus-operator.svg)](https://charts.stackradar.io/charts/cloudnativeapp/prometheus-operator)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.