cosmo 0.21.0 Helm chart

Name: cosmo Helm chart 0.21.0: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

cosmo-platform

Scored 7 Oct 2026

This is the official Helm Chart for WunderGraph Cosmo - The Full Lifecycle GraphQL API Management Solution.

Version 0.21.0App version not verified against the render 2Artifact Hub

cosmo 0.21.0 deploys 10 container images: ghcr.io/wundergraph/cosmo/cdn, ghcr.io/wundergraph/cosmo/controlplane, ghcr.io/wundergraph/cosmo/graphqlmetrics, bitnamilegacy/minio and 6 more. Across them, 2,863 findings — 17 critical, 12 high — 2 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in Redis(R) 7.2.4-5, fixed in 6.2.20.

Radar Score

34,32017125592,273

2,863 findings over 10 of 10 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

10 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/wundergraph/cosmo/cdn	0.14.1	0030228	2,662
ghcr.io/wundergraph/cosmo/controlplane×5	0.133.1	2268272	4,180
ghcr.io/wundergraph/cosmo/graphqlmetrics	0.33.0	1039127	2,086
bitnamilegacy/minio	2025.7.23-debian-12-r5	1087299	4,559
ghcr.io/wundergraph/cosmo/otelcollector	0.18.1	22102488	6,689
ghcr.io/wundergraph/cosmo/studio	0.111.0	2141198	2,946
bitnamilegacy/clickhouse	24.6.2-debian-12-r3	1255195	3,028
ghcr.io/wundergraph/cosmo/keycloak	0.13.0	0025116	1,605
bitnamilegacy/postgresql	15.4.0-debian-11-r45	4031123	2,177
bitnamilegacy/redis×2	7.2.4-debian-12-r16	4581227	4,388

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

1,391 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	DEBIAN-CVE-2025-15366	python3.11@3.11.2-6+deb12u5	no fix listed
Low	GHSA-gcjf-9mgh-3p7g	netty-codec-http@4.1.130.Final	4.1.136.Final
Low	GO-2024-2600	stdlib@go1.20.7	1.21.8
Low	ALPINE-CVE-2026-22796	openssl@3.3.3-r0	3.3.6-r0
Low	DEBIAN-CVE-2026-22796	openssl@3.0.11-1~deb12u2	3.0.18-1~deb12u2
Low	DEBIAN-CVE-2026-102010	gcc-12@12.2.0-14	no fix listed
Low	GHSA-2xp9-vwfh-vxw4	next@15.2.4	15.5.24
Low	BIT-postgresql-2023-39418	postgresql@15.4.0-6	15.4.0
Low	GHSA-fqjh-8322-vgrv	keycloak-services@26.5.4	26.6.3
Low	DEBIAN-CVE-2026-34743	xz-utils@5.4.1-0.2	5.4.1-1+deb12u1
Low	DLA-4309-1	libxslt@1.1.34-4+deb11u1	1.1.34-4+deb11u3
Low	DSA-5979-1	libxslt@1.1.35-1	1.1.35-1+deb12u2
Low	GO-2026-4440	golang.org/x/net@v0.33.0	0.45.0
Low	DEBIAN-CVE-2025-0395	glibc@2.36-9+deb12u7	2.36-9+deb12u10
Low	DEBIAN-CVE-2025-1176	binutils@2.40-2	no fix listed
Low	DEBIAN-CVE-2025-12781	python3.11@3.11.2-6+deb12u5	no fix listed
Low	DEBIAN-CVE-2026-77117	glibc@2.36-9+deb12u7	no fix listed
Low	DEBIAN-CVE-2026-80489	glibc@2.36-9+deb12u7	no fix listed
Low	GHSA-4mh8-r7rc-xpvc	fastify@4.28.1	5.12.5
Low	DEBIAN-CVE-2023-4039	gcc-12@12.2.0-14	12.2.0-14+deb12u1
Low	DSA-5678-1	glibc@2.31-13+deb11u6	2.31-13+deb11u10
Low	GHSA-j5w8-q4qc-rx2x	golang.org/x/crypto@v0.31.0	0.45.0
Low	GHSA-p6xx-57qc-3wxr	hono@4.6.12	4.12.4
Low	GHSA-g5qg-72qw-gw5v	next@15.2.4	15.4.5
Low	GO-2025-4011	stdlib@go1.21.10	1.24.8
Low	GO-2025-4015	stdlib@go1.21.10	1.24.8
Low	DEBIAN-CVE-2025-15079	curl@7.88.1-10+deb12u12	no fix listed
Low	GO-2026-4441	golang.org/x/net@v0.33.0	0.45.0
Low	DEBIAN-CVE-2026-58470	wget@1.21.3-1+b2	no fix listed
Low	GHSA-rj75-hqrm-r3gf	postcss-selector-parser@6.1.2	7.1.6
Low	DSA-5650-1	util-linux@2.36.1-8+deb11u1	2.36.1-8+deb11u2
Low	GHSA-hfvc-g4fc-pqhx	go.opentelemetry.io/otel/sdk@v1.28.0	1.43.0
Low	GHSA-38f8-5428-x5cv	netty-codec-http@4.1.130.Final	4.1.133.Final
Low	GHSA-52v5-jr5w-gjxr	sigstore@3.0.0	4.1.1
Low	GHSA-qxvw-fvwx-5cp7	mariadb-java-client@3.5.6	3.5.9
Low	DEBIAN-CVE-2026-60001	openssh@1:9.2p1-2+deb12u4	no fix listed
Low	DEBIAN-CVE-2026-58055	nghttp2@1.52.0-1+deb12u2	no fix listed
Low	GHSA-7q8q-rj6j-mhjq	axios@1.8.4	1.18.0
Low	GO-2026-5775	github.com/go-chi/chi/v5@v5.0.12	5.3.0
Low	GHSA-4633-3j49-mh5q	next@15.2.4	15.5.21
Low	GHSA-m454-3xv7-qj85	github.com/ClickHouse/ch-go@v0.61.5	0.65.0
Low	GHSA-g6gw-c38x-mqfc	hono@4.6.12	4.13.5
Low	GHSA-wjgm-6hv5-3cvf	jackson-databind@2.19.2	2.21.6
Low	GO-2026-4603	stdlib@go1.21.10	1.25.8
Low	DLA-4064-1	libxml2@2.9.10+dfsg-6.7+deb11u4	2.9.10+dfsg-6.7+deb11u6
Low	GHSA-563q-j3cm-6jxm	netty-codec-http2@4.1.130.Final	4.1.135.Final
Low	GO-2025-4175	stdlib@go1.21.10	1.24.11
Low	GHSA-qc2q-p7wx-3px3	google.golang.org/grpc@v1.71.0	1.83.1
Low	GHSA-9vqf-7f2p-gf9v	hono@4.6.12	4.12.16
Low	GHSA-qpw4-5x99-6vjp	golang.org/x/crypto@v0.31.0	0.52.0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.21.0latest	—	—	17125592,273	34,320
0.20.0	—	—	17125592,273	34,320

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/cosmo-platform/cosmo.svg)](https://charts.stackradar.io/charts/cosmo-platform/cosmo)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.