cosmo Helm chart

Name: cosmo Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

cosmo-platform

Scored 14 Sept 2026

This is the official Helm Chart for WunderGraph Cosmo - The Full Lifecycle GraphQL API Management Solution.

Latest 0.20.0App version not verified against the render 2Artifact Hub

cosmo 0.20.0 deploys 10 container images: ghcr.io/wundergraph/cosmo/cdn, ghcr.io/wundergraph/cosmo/controlplane, ghcr.io/wundergraph/cosmo/graphqlmetrics, bitnamilegacy/minio and 6 more. Across them, 2,633 findings — 8 critical, 19 high — 2 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in Redis(R) 7.2.4-5, fixed in 6.2.20.

Radar Score

28,8398194052,199

2,633 findings over 10 of 10 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

10 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/wundergraph/cosmo/cdn	0.14.1	0026211	2,357
ghcr.io/wundergraph/cosmo/controlplane×5	0.133.1	0338247	2,995
ghcr.io/wundergraph/cosmo/graphqlmetrics	0.33.0	0127127	1,619
bitnamilegacy/minio	2025.7.23-debian-12-r5	0156305	3,862
ghcr.io/wundergraph/cosmo/otelcollector	0.18.1	2281477	5,945
ghcr.io/wundergraph/cosmo/studio	0.111.0	0322176	2,116
bitnamilegacy/clickhouse	24.6.2-debian-12-r3	0348188	2,765
ghcr.io/wundergraph/cosmo/keycloak	0.13.0	0015115	1,362
bitnamilegacy/postgresql	15.4.0-debian-11-r45	2127126	2,002
bitnamilegacy/redis×2	7.2.4-debian-12-r16	4565227	3,816

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

1,276 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	GHSA-r354-f388-2fhh	hono@4.6.12	4.11.7
Low	DEBIAN-CVE-2026-13757	p11-kit@0.24.1-2	no fix listed
Low	RHSA-2026:49667	p11-kit@0.25.3-3.el9_5	0:0.26.4-1.el9_8
Low	GO-2026-5942	golang.org/x/net@v0.33.0	0.56.0
Low	DEBIAN-CVE-2025-9403	jq@1.6-2.1	no fix listed
Low	GHSA-hvcg-qmg6-jm4c	netty-codec-http@4.1.130.Final	4.1.135.Final
Low	GHSA-f88m-g3jw-g9cj	sharp@0.33.5	0.35.0
Low	GHSA-898c-q2cr-xwhg	axios@1.8.4	1.16.0
Low	GHSA-qxp5-gwg8-xv66	golang.org/x/net@v0.33.0	0.36.0
Low	DEBIAN-CVE-2025-11412	binutils@2.40-2	no fix listed
Low	DEBIAN-CVE-2025-11414	binutils@2.40-2	no fix listed
Low	GHSA-r7g4-qg5f-qqm2	nodemailer@6.9.11	8.0.8
Low	GHSA-5pq2-9x2x-5p6w	hono@4.6.12	4.12.4
Low	BIT-redis-2024-31227	Redis(R)@7.2.4-5	7.2.8
Low	BIT-redis-2024-31227	redis@7.2.4-5	7.2.8
Low	DEBIAN-CVE-2026-11850	krb5@1.20.1-2+deb12u3	no fix listed
Low	DEBIAN-CVE-2026-56132	expat@2.5.0-1+deb12u1	no fix listed
Low	DEBIAN-CVE-2025-11081	binutils@2.40-2	no fix listed
Low	DEBIAN-CVE-2025-66382	expat@2.5.0-1+deb12u1	no fix listed
Low	GO-2025-4012	stdlib@go1.21.10	1.24.8
Low	DEBIAN-CVE-2026-15146	wget@1.21.3-1+b2	no fix listed
Low	GO-2025-3956	stdlib@go1.21.10	1.23.12
Low	DEBIAN-CVE-2025-8058	glibc@2.36-9+deb12u7	2.36-9+deb12u13
Low	GHSA-p3v8-fm5p-v84h	keycloak-services@26.5.4	no fix listed
Low	GO-2026-4440	golang.org/x/net@v0.33.0	0.45.0
Low	GO-2025-4011	stdlib@go1.21.10	1.24.8
Low	GO-2025-4015	stdlib@go1.21.10	1.24.8
Low	GO-2026-6218	stdlib@go1.21.10	1.25.13
Low	DEBIAN-CVE-2026-56392	coreutils@9.1-1	no fix listed
Low	DEBIAN-CVE-2026-54370	acl@2.3.1-3	no fix listed
Low	GO-2026-4441	golang.org/x/net@v0.33.0	0.45.0
Low	DEBIAN-CVE-2005-2541	tar@1.34+dfsg-1.2+deb12u1	no fix listed
Low	DEBIAN-CVE-2025-10966	curl@7.88.1-10+deb12u12	no fix listed
Low	GHSA-9r54-q6cx-xmh5	hono@4.6.12	4.11.7
Low	GHSA-r5rp-j6wh-rvv4	hono@4.6.12	4.12.12
Low	DEBIAN-CVE-2025-1152	binutils@2.40-2	no fix listed
Low	GHSA-g8vr-x4qh-25qg	keycloak-services@26.5.4	26.6.3
Low	DEBIAN-CVE-2026-15534	perl@5.36.0-7+deb12u1	no fix listed
Low	BIT-gdal-2026-8212	GDAL@3.7.2	3.13.0
Low	GO-2025-3373	stdlib@go1.21.10	1.22.11
Low	GO-2026-5970	golang.org/x/text@v0.21.0	0.39.0
Low	GHSA-v8w9-8mx6-g223	hono@4.6.12	4.12.7
Low	DEBIAN-CVE-2025-8291	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7
Low	GHSA-268h-hp4c-crq3	nodemailer@6.9.11	8.0.9
Low	GHSA-wqvq-jvpq-h66f	nodemailer@6.9.11	8.0.9
Low	DEBIAN-CVE-2026-56391	coreutils@9.1-1	no fix listed
Low	GHSA-p77w-8qqv-26rm	hono@4.6.12	4.12.18
Low	GHSA-933f-rg6j-f46p	keycloak-services@26.5.4	26.6.2
Low	DLA-4306-1	pam@1.4.0-9+deb11u1	1.4.0-9+deb11u2
Low	GO-2025-4155	stdlib@go1.21.10	1.24.11

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.20.0latest	—	—	8194052,199	28,839

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/cosmo-platform/cosmo.svg)](https://charts.stackradar.io/charts/cosmo-platform/cosmo)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.