cosmo 0.21.0 Helm chart

Name: cosmo Helm chart 0.21.0: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

cosmo-platform

Scored 7 Oct 2026

This is the official Helm Chart for WunderGraph Cosmo - The Full Lifecycle GraphQL API Management Solution.

Version 0.21.0App version not verified against the render 2Artifact Hub

cosmo 0.21.0 deploys 10 container images: ghcr.io/wundergraph/cosmo/cdn, ghcr.io/wundergraph/cosmo/controlplane, ghcr.io/wundergraph/cosmo/graphqlmetrics, bitnamilegacy/minio and 6 more. Across them, 2,863 findings — 17 critical, 12 high — 2 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in Redis(R) 7.2.4-5, fixed in 6.2.20.

Radar Score

34,32017125592,273

2,863 findings over 10 of 10 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

10 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/wundergraph/cosmo/cdn	0.14.1	0030228	2,662
ghcr.io/wundergraph/cosmo/controlplane×5	0.133.1	2268272	4,180
ghcr.io/wundergraph/cosmo/graphqlmetrics	0.33.0	1039127	2,086
bitnamilegacy/minio	2025.7.23-debian-12-r5	1087299	4,559
ghcr.io/wundergraph/cosmo/otelcollector	0.18.1	22102488	6,689
ghcr.io/wundergraph/cosmo/studio	0.111.0	2141198	2,946
bitnamilegacy/clickhouse	24.6.2-debian-12-r3	1255195	3,028
ghcr.io/wundergraph/cosmo/keycloak	0.13.0	0025116	1,605
bitnamilegacy/postgresql	15.4.0-debian-11-r45	4031123	2,177
bitnamilegacy/redis×2	7.2.4-debian-12-r16	4581227	4,388

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

1,391 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	GO-2026-4986	stdlib@go1.21.10	1.25.10
Low	DEBIAN-CVE-2026-40356	krb5@1.20.1-2+deb12u3	1.20.1-2+deb12u5
Low	GO-2026-4918	golang.org/x/net@v0.33.0	0.53.0
Low	GO-2026-4918	stdlib@go1.21.10	1.25.10
Low	DEBIAN-CVE-2026-13221	perl@5.36.0-7+deb12u1	5.36.0-7+deb12u4
Low	DEBIAN-CVE-2026-58469	wget@1.21.3-1+b2	no fix listed
Low	DEBIAN-CVE-2026-42496	perl@5.36.0-7+deb12u1	5.36.0-7+deb12u4
Low	GHSA-9pwp-9qqc-pr26	bcprov-jdk18on@1.82	1.85
Low	GO-2025-3495	github.com/minio/minio@v0.0.0-20250723155402-7ced9663e6a7	no fix listed
Low	GHSA-q3j6-qgpj-74h6	fast-uri@2.2.0	2.4.1
Low	GHSA-mg66-mrh9-m8jx	next@15.2.4	15.5.16
Low	GHSA-267c-6grr-h53f	next@15.2.4	15.5.16
Low	GHSA-26hh-7cqf-hhc6	next@15.2.4	15.5.18
Low	GHSA-36qx-fr4f-26g5	next@15.2.4	15.5.16
Low	GHSA-j5f8-grm9-p9fc	axios@1.8.4	1.16.0
Low	GO-2024-2599	stdlib@go1.20.7	1.21.8
Low	DSA-5902-1	perl@5.36.0-7+deb12u1	5.36.0-7+deb12u2
Low	BIT-postgresql-2026-15741	postgresql@15.4.0-6	14.24.0
Low	BIT-postgresql-2026-15741	PostgreSQL@15.4.0	14.24.0
Low	DEBIAN-CVE-2025-0840	binutils@2.40-2	no fix listed
Low	BIT-postgresql-2026-14662	postgresql@15.4.0-6	14.24.0
Low	BIT-postgresql-2026-14662	PostgreSQL@15.4.0	14.24.0
Low	GHSA-vfj7-8cjw-p6xm	braces@3.0.3	no fix listed
Low	DEBIAN-CVE-2026-42013	gnutls28@3.7.9-2+deb12u2	3.7.9-2+deb12u7
Low	GHSA-mh63-6h87-95cp	github.com/golang-jwt/jwt/v5@v5.2.0	5.2.2
Low	GHSA-8gc5-j5rx-235r	fast-xml-parser@4.2.5	4.5.5
Low	BIT-postgresql-2026-6478	postgresql@15.4.0-6	14.23.0
Low	BIT-postgresql-2026-6478	PostgreSQL@15.4.0	14.23.0
Low	ALPINE-CVE-2026-31789	openssl@3.3.3-r0	3.3.7-r0
Low	DEBIAN-CVE-2026-31789	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2
Low	GHSA-r7wm-3cxj-wff9	jackson-core@2.19.2	2.21.4
Low	GHSA-c653-97m9-rcg9	netty-handler@4.1.130.Final	4.1.135.Final
Low	GHSA-558v-64gr-wgg4	netty-codec@4.1.130.Final	4.1.136.Final
Low	GHSA-mwp4-54f8-5fhr	ip-address@9.0.5	10.3.1
Low	BIT-postgresql-2026-14664	postgresql@15.4.0-6	14.24.0
Low	BIT-postgresql-2026-14664	PostgreSQL@15.4.0	14.24.0
Low	BIT-postgresql-2026-14670	postgresql@15.4.0-6	14.24.0
Low	BIT-postgresql-2026-14670	PostgreSQL@15.4.0	14.24.0
Low	ALPINE-CVE-2026-45445	openssl@3.3.3-r0	3.3.7-r1
Low	DEBIAN-CVE-2026-45445	openssl@3.0.11-1~deb12u2	3.0.20-1~deb12u2
Low	DEBIAN-CVE-2026-66032	libssh2@1.10.0-3+b1	1.10.0-3+deb12u1
Low	GHSA-pwqr-wmgm-9rr8	netty-codec-http@4.1.130.Final	4.1.132.Final
Low	DEBIAN-CVE-2024-10524	wget@1.21.3-1+b2	no fix listed
Low	BIT-minio-2025-62506	minio@2025.7.23-2	2025.10.15
Low	GHSA-jjjj-jwhf-8rgr	github.com/minio/minio@v0.0.0-20250723155402-7ced9663e6a7	0.0.0-20251015170045-c1a49490c78e
Low	DEBIAN-CVE-2026-4224	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u8
Low	BIT-postgresql-2025-8715	postgresql@15.4.0-6	13.22.0
Low	BIT-postgresql-2025-8715	PostgreSQL@15.4.0	13.22.0
Low	BIT-postgresql-2026-19385	postgresql@15.4.0-6	14.24.0
Low	BIT-postgresql-2026-19385	PostgreSQL@15.4.0	14.24.0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.21.0latest	—	—	17125592,273	34,320
0.20.0	—	—	17125592,273	34,320

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/cosmo-platform/cosmo.svg)](https://charts.stackradar.io/charts/cosmo-platform/cosmo)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.