cosmo 0.21.0 Helm chart

Name: cosmo Helm chart 0.21.0: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

cosmo-platform

Scored 7 Oct 2026

This is the official Helm Chart for WunderGraph Cosmo - The Full Lifecycle GraphQL API Management Solution.

Version 0.21.0App version not verified against the render 2Artifact Hub

cosmo 0.21.0 deploys 10 container images: ghcr.io/wundergraph/cosmo/cdn, ghcr.io/wundergraph/cosmo/controlplane, ghcr.io/wundergraph/cosmo/graphqlmetrics, bitnamilegacy/minio and 6 more. Across them, 2,863 findings — 17 critical, 12 high — 2 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in Redis(R) 7.2.4-5, fixed in 6.2.20.

Radar Score

34,32017125592,273

2,863 findings over 10 of 10 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

10 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/wundergraph/cosmo/cdn	0.14.1	0030228	2,662
ghcr.io/wundergraph/cosmo/controlplane×5	0.133.1	2268272	4,180
ghcr.io/wundergraph/cosmo/graphqlmetrics	0.33.0	1039127	2,086
bitnamilegacy/minio	2025.7.23-debian-12-r5	1087299	4,559
ghcr.io/wundergraph/cosmo/otelcollector	0.18.1	22102488	6,689
ghcr.io/wundergraph/cosmo/studio	0.111.0	2141198	2,946
bitnamilegacy/clickhouse	24.6.2-debian-12-r3	1255195	3,028
ghcr.io/wundergraph/cosmo/keycloak	0.13.0	0025116	1,605
bitnamilegacy/postgresql	15.4.0-debian-11-r45	4031123	2,177
bitnamilegacy/redis×2	7.2.4-debian-12-r16	4581227	4,388

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

1,391 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	GO-2025-4014	stdlib@go1.21.10	1.24.8
Low	GHSA-qp49-qgx5-5m26	bcprov-jdk18on@1.82	1.85
Low	RHSA-2026:42895	java-21-openjdk@1:21.0.10.0.7-1.el9	1:21.0.12.0.8-1.2.el9
Low	DEBIAN-CVE-2020-15719	openldap@2.5.13+dfsg-5	no fix listed
Low	GHSA-rr5q-3xwr-f323	keycloak-services@26.5.4	26.6.3
Low	GHSA-rr5q-3xwr-f323	keycloak-server-spi-private@26.5.4	26.6.3
Low	GO-2026-6303	golang.org/x/crypto@v0.31.0	0.55.0
Low	DEBIAN-CVE-2025-24528	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u3
Low	DEBIAN-CVE-2026-66034	libssh2@1.10.0-3+b1	1.10.0-3+deb12u1
Low	GO-2026-6354	golang.org/x/crypto@v0.31.0	0.56.0
Low	RHSA-2026:20597	glibc@2.34-231.el9_7.10	0:2.34-270.el9_8
Low	GHSA-wc8c-qw6v-h7f6	@hono/node-server@1.13.7	1.19.10
Low	DEBIAN-CVE-2026-11822	sqlite3@3.40.1-2+deb12u1	no fix listed
Low	GO-2023-2382	stdlib@go1.20.7	1.20.12
Low	DEBIAN-CVE-2026-2219	dpkg@1.21.22	1.21.23
Low	GHSA-xvr9-35cr-46v9	mariadb-java-client@3.5.6	3.5.9
Low	GHSA-w4p5-rfh6-cwrv	keycloak-services@26.5.4	26.6.2
Low	DEBIAN-CVE-2026-3276	python3.11@3.11.2-6+deb12u5	no fix listed
Low	DEBIAN-CVE-2025-7458	sqlite3@3.40.1-2+deb12u1	no fix listed
Low	GHSA-cfpf-hrx2-8rv6	github.com/expr-lang/expr@v1.16.9	1.17.7
Low	DEBIAN-CVE-2025-15661	libssh2@1.10.0-3+b1	1.10.0-3+deb12u1
Low	BIT-postgresql-2026-14668	postgresql@15.4.0-6	14.24.0
Low	BIT-postgresql-2026-14668	PostgreSQL@15.4.0	14.24.0
Low	GHSA-mm7p-fcc7-pg87	nodemailer@6.9.11	7.0.7
Low	DEBIAN-CVE-2026-19553	python3.11@3.11.2-6+deb12u5	no fix listed
Low	DEBIAN-CVE-2025-24928	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u2
Low	GHSA-gpj5-g38j-94v9	drizzle-orm@0.35.3	0.45.2
Low	GHSA-r6q2-hw4h-h46w	tar@7.4.3	7.5.4
Low	ALPINE-CVE-2026-75803	openssl@3.3.3-r0	3.3.7-r1
Low	DEBIAN-CVE-2026-75803	openssl@3.0.11-1~deb12u2	3.0.22-1~deb12u1
Low	DEBIAN-CVE-2026-42012	gnutls28@3.7.9-2+deb12u2	3.7.9-2+deb12u7
Low	GHSA-wg65-39gg-5wfj	github.com/prometheus/prometheus@v0.303.0	0.311.3
Low	GHSA-c3fc-8qff-9hwx	bcprov-jdk18on@1.82	1.84
Low	RHSA-2026:18599	p11-kit@0.25.3-3.el9_5	0:0.26.2-1.el9
Low	GO-2024-3105	stdlib@go1.21.10	1.22.7
Low	GHSA-wg6q-6289-32hp	bcpkix-jdk18on@1.82	1.84
Low	GO-2025-4007	stdlib@go1.21.10	1.24.9
Low	ALPINE-CVE-2025-15468	openssl@3.3.3-r0	3.3.6-r0
Low	ALPINE-CVE-2026-84784	openssl@3.3.3-r0	3.3.7-r2
Low	DEBIAN-CVE-2024-4603	openssl@3.0.11-1~deb12u2	3.0.14-1~deb12u1
Low	GHSA-f886-m6hf-6m8v	brace-expansion@2.0.1	2.0.3
Low	DEBIAN-CVE-2026-12064	curl@7.88.1-10+deb12u12	no fix listed
Low	GHSA-2g4f-4pwh-qvx6	ajv@8.12.0	8.18.0
Low	GHSA-p436-gjf2-799p	github.com/docker/cli@v26.1.3+incompatible	29.2.0
Low	DEBIAN-CVE-2026-8932	curl@7.88.1-10+deb12u12	no fix listed
Low	DEBIAN-CVE-2024-55549	libxslt@1.1.35-1	1.1.35-1+deb12u1
Low	DEBIAN-CVE-2025-24855	libxslt@1.1.35-1	1.1.35-1+deb12u1
Low	DEBIAN-CVE-2026-95619	gcc-12@12.2.0-14	no fix listed
Low	DSA-5863-1	libtasn1-6@4.19.0-2	4.19.0-2+deb12u1
Low	DEBIAN-CVE-2026-8286	curl@7.88.1-10+deb12u12	no fix listed

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.21.0latest	—	—	17125592,273	34,320
0.20.0	—	—	17125592,273	34,320

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/cosmo-platform/cosmo.svg)](https://charts.stackradar.io/charts/cosmo-platform/cosmo)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.