cosmo 0.21.0 Helm chart

Name: cosmo Helm chart 0.21.0: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

cosmo-platform

Scored 7 Oct 2026

This is the official Helm Chart for WunderGraph Cosmo - The Full Lifecycle GraphQL API Management Solution.

Version 0.21.0App version not verified against the render 2Artifact Hub

cosmo 0.21.0 deploys 10 container images: ghcr.io/wundergraph/cosmo/cdn, ghcr.io/wundergraph/cosmo/controlplane, ghcr.io/wundergraph/cosmo/graphqlmetrics, bitnamilegacy/minio and 6 more. Across them, 2,863 findings — 17 critical, 12 high — 2 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in Redis(R) 7.2.4-5, fixed in 6.2.20.

Radar Score

34,32017125592,273

2,863 findings over 10 of 10 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

10 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/wundergraph/cosmo/cdn	0.14.1	0030228	2,662
ghcr.io/wundergraph/cosmo/controlplane×5	0.133.1	2268272	4,180
ghcr.io/wundergraph/cosmo/graphqlmetrics	0.33.0	1039127	2,086
bitnamilegacy/minio	2025.7.23-debian-12-r5	1087299	4,559
ghcr.io/wundergraph/cosmo/otelcollector	0.18.1	22102488	6,689
ghcr.io/wundergraph/cosmo/studio	0.111.0	2141198	2,946
bitnamilegacy/clickhouse	24.6.2-debian-12-r3	1255195	3,028
ghcr.io/wundergraph/cosmo/keycloak	0.13.0	0025116	1,605
bitnamilegacy/postgresql	15.4.0-debian-11-r45	4031123	2,177
bitnamilegacy/redis×2	7.2.4-debian-12-r16	4581227	4,388

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

1,391 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	GHSA-9m57-25v3-79x9	golang.org/x/crypto@v0.31.0	0.52.0
Low	GO-2026-4864	stdlib@go1.21.10	1.25.9
Low	GO-2026-6179	golang.org/x/mod@v0.17.0	0.40.0
Low	DEBIAN-CVE-2024-22365	pam@1.5.2-6+deb12u1	1.5.2-6+deb12u2
Low	DEBIAN-CVE-2026-6429	curl@7.88.1-10+deb12u12	no fix listed
Low	DSA-5883-1	mercurial@6.3.2-1	6.3.2-1+deb12u1
Low	GHSA-v2v4-37r5-5v8g	ip-address@9.0.5	10.1.1
Low	GHSA-f6x5-jh6r-wrfv	golang.org/x/crypto@v0.31.0	0.45.0
Low	DEBIAN-CVE-2025-15367	python3.11@3.11.2-6+deb12u5	no fix listed
Low	GHSA-6wqw-2p9w-4vw4	hono@4.6.12	4.11.7
Low	GO-2026-4865	stdlib@go1.21.10	1.25.9
Low	GO-2026-4982	stdlib@go1.21.10	1.25.10
Low	GO-2026-5025	golang.org/x/net@v0.33.0	0.55.0
Low	GHSA-3v7f-55p6-f55p	picomatch@2.3.1	2.3.2
Low	GHSA-5x3r-wrvg-rp6q	netty-codec-http2@4.1.130.Final	4.1.135.Final
Low	GHSA-gvwx-54wh-qm9j	tar@7.4.3	7.5.17
Low	DEBIAN-CVE-2026-86143	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	GHSA-h3mg-xc3c-68pw	ip-address@9.0.5	10.7.1
Low	DEBIAN-CVE-2026-3783	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15
Low	GHSA-3vhc-576x-3qv4	hono@4.6.12	4.11.4
Low	DEBIAN-CVE-2026-86140	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	DEBIAN-CVE-2026-86142	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	BIT-minio-2026-34204	minio@2025.7.23-2	no fix listed
Low	GHSA-3rh2-v3gr-35p9	github.com/minio/minio@v0.0.0-20250723155402-7ced9663e6a7	no fix listed
Low	DEBIAN-CVE-2025-10148	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15
Low	GHSA-w62v-xxxg-mg59	hono@4.6.12	4.12.27
Low	DEBIAN-CVE-2026-78410	util-linux@2.38.1-5+deb12u1	no fix listed
Low	DEBIAN-CVE-2026-4873	curl@7.88.1-10+deb12u12	no fix listed
Low	DEBIAN-CVE-2026-89160	pcre2@10.42-1	10.42-1+deb12u1
Low	GHSA-68g3-v927-f742	next@15.2.4	15.5.21
Low	DEBIAN-CVE-2024-26462	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u3
Low	GHSA-83g3-92jg-28cx	tar@7.4.3	7.5.8
Low	DLA-4437-1	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3
Low	DEBIAN-CVE-2026-102633	expat@2.5.0-1+deb12u1	no fix listed
Low	GHSA-5c9x-8gcm-mpgx	axios@1.8.4	1.15.1
Low	GHSA-vf2m-468p-8v99	axios@1.8.4	1.15.1
Low	DEBIAN-CVE-2026-1965	curl@7.88.1-10+deb12u12	no fix listed
Low	GHSA-vffh-x6r8-xx99	github.com/prometheus/prometheus@v0.303.0	0.311.2-0.20260410083055-07c6232d159b
Low	DEBIAN-CVE-2022-0563	util-linux@2.38.1-5+deb12u1	no fix listed
Low	DEBIAN-CVE-2025-3576	krb5@1.20.1-2+deb12u3	1.20.1-2+deb12u4
Low	GHSA-rgj7-g3m4-5g8c	sharp@0.33.5	0.35.4
Low	GHSA-wq5f-xc86-pv6w	sharp@0.33.5	0.35.5
Low	GO-2026-6091	stdlib@go1.21.10	1.25.13
Low	DEBIAN-CVE-2026-11979	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	BIT-postgresql-2025-12818	postgresql@15.4.0-6	13.23.0
Low	BIT-postgresql-2025-12818	PostgreSQL@15.4.0	13.23.0
Low	GO-2025-4008	stdlib@go1.21.10	1.24.8
Low	GO-2025-4010	stdlib@go1.21.10	1.24.8
Low	GHSA-w332-q679-j88p	hono@4.6.12	4.11.7
Low	DEBIAN-CVE-2007-2768	openssh@1:9.2p1-2+deb12u4	no fix listed

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.21.0latest	—	—	17125592,273	34,320
0.20.0	—	—	17125592,273	34,320

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/cosmo-platform/cosmo.svg)](https://charts.stackradar.io/charts/cosmo-platform/cosmo)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.