cosmo Helm chart

Name: cosmo Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

cosmo-platform

Scored 14 Sept 2026

This is the official Helm Chart for WunderGraph Cosmo - The Full Lifecycle GraphQL API Management Solution.

Latest 0.20.0App version not verified against the render 2Artifact Hub

cosmo 0.20.0 deploys 10 container images: ghcr.io/wundergraph/cosmo/cdn, ghcr.io/wundergraph/cosmo/controlplane, ghcr.io/wundergraph/cosmo/graphqlmetrics, bitnamilegacy/minio and 6 more. Across them, 2,633 findings — 8 critical, 19 high — 2 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in Redis(R) 7.2.4-5, fixed in 6.2.20.

Radar Score

28,8398194052,199

2,633 findings over 10 of 10 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

10 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/wundergraph/cosmo/cdn	0.14.1	0026211	2,357
ghcr.io/wundergraph/cosmo/controlplane×5	0.133.1	0338247	2,995
ghcr.io/wundergraph/cosmo/graphqlmetrics	0.33.0	0127127	1,619
bitnamilegacy/minio	2025.7.23-debian-12-r5	0156305	3,862
ghcr.io/wundergraph/cosmo/otelcollector	0.18.1	2281477	5,945
ghcr.io/wundergraph/cosmo/studio	0.111.0	0322176	2,116
bitnamilegacy/clickhouse	24.6.2-debian-12-r3	0348188	2,765
ghcr.io/wundergraph/cosmo/keycloak	0.13.0	0015115	1,362
bitnamilegacy/postgresql	15.4.0-debian-11-r45	2127126	2,002
bitnamilegacy/redis×2	7.2.4-debian-12-r16	4565227	3,816

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

1,052 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	GHSA-38f8-5428-x5cv	netty-codec-http@4.1.130.Final	4.1.133.Final
Low	GHSA-28wg-ghj8-5hjv	nanoid@3.3.7	3.3.16
Low	DEBIAN-CVE-2026-3783	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15
Low	GHSA-w9j2-pvgh-6h63	axios@1.8.4	1.15.1
Low	DEBIAN-CVE-2026-4873	curl@7.88.1-10+deb12u12	no fix listed
Low	GHSA-8c42-7qj2-3j46	netty-codec-http@4.1.130.Final	4.1.137.Final
Low	GO-2024-2609	stdlib@go1.20.7	1.21.8
Low	DEBIAN-CVE-2026-59999	openssh@1:9.2p1-2+deb12u4	no fix listed
Low	DEBIAN-CVE-2026-34743	xz-utils@5.4.1-0.2	5.4.1-1+deb12u1
Low	GHSA-92vj-g62v-jqhh	hono@4.6.12	4.9.7
Low	GO-2024-3107	stdlib@go1.21.10	1.22.7
Low	DEBIAN-CVE-2026-5704	tar@1.34+dfsg-1.2+deb12u1	no fix listed
Low	GHSA-p6xx-57qc-3wxr	hono@4.6.12	4.12.4
Low	GHSA-r7wm-3cxj-wff9	jackson-core@2.19.2	2.21.4
Low	GHSA-2v37-7h3g-55p8	nanoid@3.3.7	3.3.18
Low	DEBIAN-CVE-2026-3441	binutils@2.40-2	no fix listed
Low	DEBIAN-CVE-2026-35387	openssh@1:9.2p1-2+deb12u4	1:9.2p1-2+deb12u10
Low	DEBIAN-CVE-2026-3184	util-linux@2.38.1-5+deb12u1	no fix listed
Low	GHSA-cp6g-7hqx-qxhp	go.mongodb.org/mongo-driver@v1.17.3	1.17.7
Low	GHSA-58qx-3vcg-4xpx	ws@8.13.0	8.20.1
Low	GHSA-w332-q679-j88p	hono@4.6.12	4.11.7
Low	DEBIAN-CVE-2026-58055	nghttp2@1.52.0-1+deb12u2	no fix listed
Low	RHSA-2026:33226	glibc@2.34-231.el9_7.10	0:2.34-272.el9_8
Low	DEBIAN-CVE-2026-7010	perl@5.36.0-7+deb12u1	no fix listed
Low	GHSA-4mp9-239f-g9hg	netty-codec-http@4.1.130.Final	4.1.136.Final
Low	DEBIAN-CVE-2026-19487	perl@5.36.0-7+deb12u1	no fix listed
Low	GHSA-26pp-8wgv-hjvm	hono@4.6.12	4.12.12
Low	GHSA-cpf7-j4cf-vqx4	keycloak-services@26.5.4	26.6.3
Low	DEBIAN-CVE-2023-52426	expat@2.5.0-1+deb12u1	no fix listed
Low	RHSA-2026:12441	libcap@2.48-10.el9	0:2.48-10.el9_7.1
Low	GHSA-9m57-25v3-79x9	golang.org/x/crypto@v0.31.0	0.52.0
Low	GHSA-3v7f-55p6-f55p	picomatch@2.3.1	2.3.2
Low	GHSA-mh29-5h37-fv8m	js-yaml@4.1.0	4.1.1
Low	DEBIAN-CVE-2026-89158	pcre2@10.42-1	10.42-1+deb12u1
Low	GHSA-9vqf-7f2p-gf9v	hono@4.6.12	4.12.16
Low	GHSA-x86f-5xw2-fm2r	github.com/docker/docker@v26.1.3+incompatible	no fix listed
Low	GO-2023-2041	stdlib@go1.20.7	1.20.8
Low	DEBIAN-CVE-2025-27587	openssl@3.0.11-1~deb12u2	no fix listed
Low	GHSA-7q8q-rj6j-mhjq	axios@1.8.4	1.18.0
Low	GHSA-vffh-x6r8-xx99	github.com/prometheus/prometheus@v0.303.0	0.311.2-0.20260410083055-07c6232d159b
Low	GO-2023-2043	stdlib@go1.20.7	1.20.8
Low	DEBIAN-CVE-2013-4392	systemd@252.22-1~deb12u1	no fix listed
Low	GHSA-8hxp-qmph-w5gq	keycloak-model-storage-services@26.5.4	no fix listed
Low	GO-2023-2186	stdlib@go1.20.7	1.20.11
Low	GHSA-g6gw-c38x-mqfc	hono@4.6.12	4.13.5
Low	GHSA-h67p-54hq-rp68	js-yaml@4.1.0	4.2.0
Low	BIT-postgresql-2024-4317	PostgreSQL@15.4.0	14.12.0
Low	BIT-postgresql-2024-4317	postgresql@15.4.0-6	14.12.0
Low	BIT-postgresql-2024-10976	PostgreSQL@15.4.0	13.17.0
Low	BIT-postgresql-2024-10976	postgresql@15.4.0-6	13.17.0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.20.0latest	—	—	8194052,199	28,839

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/cosmo-platform/cosmo.svg)](https://charts.stackradar.io/charts/cosmo-platform/cosmo)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.