cosmo 0.21.0 Helm chart

Name: cosmo Helm chart 0.21.0: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

cosmo-platform

Scored 7 Oct 2026

This is the official Helm Chart for WunderGraph Cosmo - The Full Lifecycle GraphQL API Management Solution.

Version 0.21.0App version not verified against the render 2Artifact Hub

cosmo 0.21.0 deploys 10 container images: ghcr.io/wundergraph/cosmo/cdn, ghcr.io/wundergraph/cosmo/controlplane, ghcr.io/wundergraph/cosmo/graphqlmetrics, bitnamilegacy/minio and 6 more. Across them, 2,863 findings — 17 critical, 12 high — 2 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in Redis(R) 7.2.4-5, fixed in 6.2.20.

Radar Score

34,32017125592,273

2,863 findings over 10 of 10 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

10 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/wundergraph/cosmo/cdn	0.14.1	0030228	2,662
ghcr.io/wundergraph/cosmo/controlplane×5	0.133.1	2268272	4,180
ghcr.io/wundergraph/cosmo/graphqlmetrics	0.33.0	1039127	2,086
bitnamilegacy/minio	2025.7.23-debian-12-r5	1087299	4,559
ghcr.io/wundergraph/cosmo/otelcollector	0.18.1	22102488	6,689
ghcr.io/wundergraph/cosmo/studio	0.111.0	2141198	2,946
bitnamilegacy/clickhouse	24.6.2-debian-12-r3	1255195	3,028
ghcr.io/wundergraph/cosmo/keycloak	0.13.0	0025116	1,605
bitnamilegacy/postgresql	15.4.0-debian-11-r45	4031123	2,177
bitnamilegacy/redis×2	7.2.4-debian-12-r16	4581227	4,388

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

1,097 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	GHSA-wjgm-6hv5-3cvf	jackson-databind@2.19.2	2.21.6
Low	GO-2026-4603	stdlib@go1.21.10	1.25.8
Low	DLA-4064-1	libxml2@2.9.10+dfsg-6.7+deb11u4	2.9.10+dfsg-6.7+deb11u6
Low	GHSA-563q-j3cm-6jxm	netty-codec-http2@4.1.130.Final	4.1.135.Final
Low	GO-2025-4175	stdlib@go1.21.10	1.24.11
Low	GHSA-qc2q-p7wx-3px3	google.golang.org/grpc@v1.71.0	1.83.1
Low	GHSA-9vqf-7f2p-gf9v	hono@4.6.12	4.12.16
Low	GHSA-qpw4-5x99-6vjp	golang.org/x/crypto@v0.31.0	0.52.0
Low	GHSA-9m57-25v3-79x9	golang.org/x/crypto@v0.31.0	0.52.0
Low	GO-2026-4864	stdlib@go1.21.10	1.25.9
Low	GO-2026-6179	golang.org/x/mod@v0.17.0	0.40.0
Low	DEBIAN-CVE-2024-22365	pam@1.5.2-6+deb12u1	1.5.2-6+deb12u2
Low	DEBIAN-CVE-2026-6429	curl@7.88.1-10+deb12u12	no fix listed
Low	DSA-5883-1	mercurial@6.3.2-1	6.3.2-1+deb12u1
Low	GHSA-v2v4-37r5-5v8g	ip-address@9.0.5	10.1.1
Low	GHSA-f6x5-jh6r-wrfv	golang.org/x/crypto@v0.31.0	0.45.0
Low	DEBIAN-CVE-2025-15367	python3.11@3.11.2-6+deb12u5	no fix listed
Low	GHSA-6wqw-2p9w-4vw4	hono@4.6.12	4.11.7
Low	GO-2026-4865	stdlib@go1.21.10	1.25.9
Low	GO-2026-4982	stdlib@go1.21.10	1.25.10
Low	GO-2026-5025	golang.org/x/net@v0.33.0	0.55.0
Low	GHSA-3v7f-55p6-f55p	picomatch@2.3.1	2.3.2
Low	GHSA-5x3r-wrvg-rp6q	netty-codec-http2@4.1.130.Final	4.1.135.Final
Low	GHSA-gvwx-54wh-qm9j	tar@7.4.3	7.5.17
Low	DEBIAN-CVE-2026-86143	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	GHSA-h3mg-xc3c-68pw	ip-address@9.0.5	10.7.1
Low	DEBIAN-CVE-2026-3783	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15
Low	GHSA-3vhc-576x-3qv4	hono@4.6.12	4.11.4
Low	DEBIAN-CVE-2026-86140	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	DEBIAN-CVE-2026-86142	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	BIT-minio-2026-34204	minio@2025.7.23-2	no fix listed
Low	GHSA-3rh2-v3gr-35p9	github.com/minio/minio@v0.0.0-20250723155402-7ced9663e6a7	no fix listed
Low	DEBIAN-CVE-2025-10148	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15
Low	GHSA-w62v-xxxg-mg59	hono@4.6.12	4.12.27
Low	DEBIAN-CVE-2026-78410	util-linux@2.38.1-5+deb12u1	no fix listed
Low	DEBIAN-CVE-2026-4873	curl@7.88.1-10+deb12u12	no fix listed
Low	DEBIAN-CVE-2026-89160	pcre2@10.42-1	10.42-1+deb12u1
Low	GHSA-68g3-v927-f742	next@15.2.4	15.5.21
Low	DEBIAN-CVE-2024-26462	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u3
Low	GHSA-83g3-92jg-28cx	tar@7.4.3	7.5.8
Low	DLA-4437-1	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3
Low	DEBIAN-CVE-2026-102633	expat@2.5.0-1+deb12u1	no fix listed
Low	GHSA-5c9x-8gcm-mpgx	axios@1.8.4	1.15.1
Low	GHSA-vf2m-468p-8v99	axios@1.8.4	1.15.1
Low	DEBIAN-CVE-2026-1965	curl@7.88.1-10+deb12u12	no fix listed
Low	GHSA-vffh-x6r8-xx99	github.com/prometheus/prometheus@v0.303.0	0.311.2-0.20260410083055-07c6232d159b
Low	DEBIAN-CVE-2022-0563	util-linux@2.38.1-5+deb12u1	no fix listed
Low	DEBIAN-CVE-2025-3576	krb5@1.20.1-2+deb12u3	1.20.1-2+deb12u4
Low	GHSA-rgj7-g3m4-5g8c	sharp@0.33.5	0.35.4
Low	GHSA-wq5f-xc86-pv6w	sharp@0.33.5	0.35.5

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.21.0latest	—	—	17125592,273	34,320
0.20.0	—	—	17125592,273	34,320

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/cosmo-platform/cosmo.svg)](https://charts.stackradar.io/charts/cosmo-platform/cosmo)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.