drogue-cloud-metrics Helm chart

Name: drogue-cloud-metrics Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

drogue-iot

Scored 14 Sept 2026

Drogue IoT Cloud metrics stack installation

Latest 0.7.11 3 years agodeploys tag v1.1.2 0Artifact Hub

drogue-cloud-metrics 0.7.11 deploys 8 container images: quay.io/prometheus/node-exporter, quay.io/kiwigrid/k8s-sidecar, grafana/grafana, k8s.gcr.io/kube-state-metrics/kube-state-metrics and 4 more. Across the 7 measured, 1,198 findings — 0 critical, 22 high — 4 on CISA KEV. The highest contribution is ALPINE-CVE-2023-0286 in openssl 1.1.1o-r0, fixed in 1.1.1t-r0. Chart.yaml declares kubeVersion >= 1.22.0; rendered for Kubernetes 1.22.0.

Radar Score

13,5580221711,005

1,198 findings over 7 of 8 images measured

KEV ×4 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

8 images

Image	Tag	Vulnerabilities	Radar Score
quay.io/prometheus/node-exporter	v1.1.2	0326158	2,106
quay.io/kiwigrid/k8s-sidecar×2	1.19.2	042826	1,058
grafana/grafana	9.2.4	0637198	2,839
k8s.gcr.io/kube-state-metrics/kube-state-metrics	v2.1.1	—	unmeasured
quay.io/prometheus/alertmanager	v0.21.0	0429165	2,305
jimmidyson/configmap-reload×2	v0.5.0	008125	1,260
prom/pushgateway	v1.3.1	008126	1,272
quay.io/prometheus/prometheus	v2.26.0	0535207	2,718

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

398 distinct across the version’s images

Severity	Advisory	Package	Fixed in
High	ALPINE-CVE-2023-0286	openssl@1.1.1o-r0	1.1.1t-r0
High	ALPINE-CVE-2023-2650	openssl@1.1.1o-r0	1.1.1u-r0
High	GHSA-45x7-px36-x8w8	golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d	0.0.0-20231218163308-9d2ee975ef9f
High	ALPINE-CVE-2022-37434	zlib@1.2.12-r1	1.2.12-r2
High	GHSA-v23v-6jw2-98fq	github.com/docker/docker@v20.10.5+incompatible	23.0.15
High	GHSA-qppj-fm5r-hxr3KEV	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591	0.17.0
High	GHSA-4v7x-pqxf-cx7m	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591	0.23.0
High	GHSA-crp2-qrr5-8pq7	github.com/containerd/containerd@v1.4.3	1.4.13
High	GHSA-ffhg-7mh4-33c4	golang.org/x/crypto@v0.0.0-20191011191535-87dc89f01550	0.0.0-20200220183623-bac4c82f6975
High	ALPINE-CVE-2022-4450	openssl@1.1.1o-r0	1.1.1t-r0
Medium	GO-2025-3704	github.com/grafana/grafana@v9.2.4	no fix listed
Medium	GO-2024-3215	github.com/grafana/grafana@v9.2.4	no fix listed
Medium	GO-2024-2687	stdlib@go1.19.3	1.21.9
Medium	GHSA-5cgq-3rg8-m6cv	golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d	0.52.0
Medium	GO-2024-2857	github.com/grafana/grafana@v9.2.4	no fix listed
Medium	ALPINE-CVE-2022-42898	krb5@1.19.3-r0	1.19.4-r0
Medium	ALPINE-CVE-2022-4304	openssl@1.1.1o-r0	1.1.1t-r0
Medium	GHSA-mpv3-g8m3-3fjc	github.com/grafana/grafana@v9.2.4	9.2.20
Medium	GHSA-83g2-8m93-v3w7	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b	0.0.0-20210520170846-37e1c6afe023
Medium	GO-2025-3817	github.com/grafana/grafana@v9.2.4	no fix listed
Medium	GHSA-cg3q-j54f-5p7p	github.com/prometheus/client_golang@v1.9.0	1.11.1
Medium	GHSA-hjv9-hm2f-rpcj	github.com/grafana/grafana@v9.2.4	9.2.13
Medium	GHSA-v778-237x-gjrc	golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d	0.31.0
Medium	GHSA-c3h9-896r-86jm	github.com/gogo/protobuf@v1.3.1	1.3.2
Medium	GHSA-vvpx-j8f3-3w6h	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591	0.7.0
Medium	ALPINE-CVE-2023-0215	openssl@1.1.1o-r0	1.1.1t-r0
Medium	GHSA-hp87-p4gw-j4gq	gopkg.in/yaml.v3@v3.0.0-20210107192922-496545a6307b	3.0.1
Medium	GHSA-8c26-wmh5-6g9v	golang.org/x/crypto@v0.0.0-20201208171446-5f87f3452ae9	0.0.0-20220314234659-1baeb1ce4c0b
Medium	GHSA-4374-p667-p6c8	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591	0.17.0
Medium	ALPINE-CVE-2023-0464	openssl@1.1.1o-r0	1.1.1t-r1
Medium	GHSA-xw5p-hw8j-xg4q	github.com/grafana/grafana@v9.2.4	9.2.13
Medium	GHSA-449p-3h89-pw88	github.com/go-git/go-git/v5@v5.4.2	5.11.0
Medium	GHSA-69cg-p879-7622	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b	0.0.0-20220906165146-f3363e06e74c
Medium	GHSA-3vm4-22fp-5rfm	golang.org/x/crypto@v0.0.0-20201208171446-5f87f3452ae9	0.0.0-20201216223049-8b5274cf687f
Medium	GHSA-cx63-2mw6-8hw5	setuptools@58.1.0	70.0.0
Medium	GHSA-38jv-5279-wg99	urllib3@1.26.9	2.6.3
Medium	GHSA-v725-9546-7q7m	github.com/go-git/go-git/v5@v5.4.2	5.13.0
Medium	GO-2025-4153	github.com/grafana/grafana@v9.2.4	no fix listed
Medium	ALPINE-CVE-2022-40674	expat@2.4.8-r0	2.4.9-r0
Medium	GHSA-p77j-4mvh-x3m3	google.golang.org/grpc@v1.45.0	1.79.3
Medium	ALPINE-CVE-2021-46828	libtirpc@1.3.2-r0	1.3.2-r1
Medium	GHSA-qwmp-2cf2-g9g6	wheel@0.37.1	0.38.1
Medium	GHSA-cjjc-xp8v-855w	golang.org/x/crypto@v0.0.0-20191011191535-87dc89f01550	0.0.0-20200124225646-8b5121be2f68
Medium	GHSA-r9hx-vwmv-q579	setuptools@58.1.0	65.5.1
Medium	GHSA-232p-vwff-86mp	github.com/docker/docker@v20.10.5+incompatible	20.10.24
Medium	ALPINE-CVE-2022-43680	expat@2.4.8-r0	2.5.0-r0
Medium	PYSEC-2025-49	setuptools@58.1.0	78.1.1
Medium	ALPINE-CVE-2023-3446	openssl@1.1.1o-r0	1.1.1u-r2
Medium	ALPINE-CVE-2024-28757	expat@2.4.8-r0	2.6.2-r0
Medium	GHSA-xrjj-mj9h-534m	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591	0.4.0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.7.11latest	3 years ago	v1.1.2	0221711,005	13,558

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/drogue-iot/drogue-cloud-metrics.svg)](https://charts.stackradar.io/charts/drogue-iot/drogue-cloud-metrics)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.