StackRadar

galoy Helm chart

galoymoney

Scored 14 Sept 2026

A Helm chart for galoy servers

Latest 0.34.7 1 year agodeploys tag v2.2.0 0Artifact Hub

galoy 0.34.7 deploys 24 container images: oryd/hydra, oryd/kratos, oryd/oathkeeper, us.gcr.io/galoy-org/price-history and 20 more. Across the 5 measured, 728 findings2 critical, 24 high 5 on CISA KEV. The highest contribution is ALPINE-CVE-2023-38545 in curl 7.83.1-r4, fixed in 8.4.0-r0.

Radar Score

8,677224119583

728 findings over 5 of 24 images measured

KEV ×5 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

24 images
ImageTagVulnerabilitiesRadar Score
oryd/hydrav2.2.003171261,524
oryd/kratos×3v1.0.007291502,174
oryd/oathkeeperv0.40.605301361,980
us.gcr.io/galoy-org/price-history×2digest-pinnedunmeasured
us.gcr.io/galoy-org/pricedigest-pinnedunmeasured
ghcr.io/apollographql/routerv1.25.001427382
groundnuty/k8s-wait-for×5v2.028391442,617
us.gcr.io/galoy-org/galoy-apidigest-pinnedunmeasured
us.gcr.io/galoy-org/galoy-api-keysdigest-pinnedunmeasured
us.gcr.io/galoy-org/galoy-consentdigest-pinnedunmeasured
us.gcr.io/galoy-org/galoy-api-exporterdigest-pinnedunmeasured
us.gcr.io/galoy-org/galoy-notifications×2digest-pinnedunmeasured
us.gcr.io/galoy-org/galoy-api-triggerdigest-pinnedunmeasured
us.gcr.io/galoy-org/galoy-api-ws-serverdigest-pinnedunmeasured
bitnami/mongodb×27.0.14-debian-12-r3unmeasured
bitnami/mongodb-exporter0.41.0-debian-12-r0unmeasured
bitnami/postgresql16.2.0-debian-12-r8unmeasured
bitnami/redis7.4.1-debian-12-r0unmeasured
bitnami/redis-sentinel7.4.1-debian-12-r0unmeasured
bitnami/redis-exporter1.63.0-debian-12-r1unmeasured
us.gcr.io/galoy-org/price-history-migratedigest-pinnedunmeasured
us.gcr.io/galoy-org/galoy-api-migratedigest-pinnedunmeasured
us.gcr.io/galoy-org/galoy-api-crondigest-pinnedunmeasured
us.gcr.io/galoy-org/mongo-backupdigest-pinnedunmeasured

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

302 distinct across the version’s images
SeverityAdvisoryPackageFixed in
LowGHSA-2wrh-6pvc-2jm9golang.org/x/net@v0.8.00.13.0
LowGO-2023-2185stdlib@go1.20.51.20.11
LowALPINE-CVE-2024-4603openssl@3.1.1-r13.1.5-r0
LowGHSA-4x4m-3c2p-qppck8s.io/kubernetes@v1.25.41.31.12
LowGHSA-p436-gjf2-799pgithub.com/docker/cli@v20.10.21+incompatible29.2.0
LowGHSA-c5q2-7r4c-mv6ggithub.com/go-jose/go-jose/v3@v3.0.13.0.3
LowGHSA-c5q2-7r4c-mv6ggopkg.in/square/go-jose.v2@v2.6.0no fix listed
LowGHSA-mq39-4gv4-mvpxgithub.com/docker/docker@v20.10.24+incompatible23.0.11
LowGHSA-3wgm-2gw2-vh5mk8s.io/kubernetes@v1.25.4no fix listed
LowGO-2023-1703stdlib@go1.19.31.19.8
LowDSA-5650-1util-linux@2.36.1-8+deb11u12.36.1-8+deb11u2
LowGO-2026-4341stdlib@go1.20.51.24.12
LowGHSA-r9w3-57w2-gch2github.com/ory/hydra/v2@v2.2.02.3.1-0.20260320110106-0b84568fffcc
LowGHSA-c6gw-w398-hv78github.com/go-jose/go-jose/v3@v3.0.13.0.4
LowGO-2024-2887stdlib@go1.20.51.21.11
LowGHSA-pxq6-2prw-chj9github.com/docker/docker@v20.10.24+incompatibleno fix listed
LowGO-2023-1704stdlib@go1.19.31.19.8
LowALPINE-CVE-2025-26519musl@1.2.4-r01.2.4-r3
LowDSA-5726-1krb5@1.18.3-6+deb11u31.18.3-6+deb11u5
LowGHSA-6wxm-mpqj-6jpfgithub.com/golang/glog@v1.0.01.2.4
LowALPINE-CVE-2023-28322curl@7.83.1-r48.1.0-r0
LowGO-2023-1568stdlib@go1.19.31.19.6
LowGO-2023-1987stdlib@go1.20.51.19.12
LowGHSA-hfvc-g4fc-pqhxgo.opentelemetry.io/otel/sdk@v1.21.01.43.0
LowGO-2023-1752stdlib@go1.19.31.19.9
LowDLA-4321-1openssl@1.1.1n-0+deb11u51.1.1w-0+deb11u4
LowDLA-3926-1perl@5.32.1-4+deb11u25.32.1-4+deb11u4
LowGHSA-mh55-gqvf-xfwmgithub.com/rs/cors@v1.9.01.11.0
LowGO-2023-1705stdlib@go1.19.31.19.8
LowGHSA-hgx2-28f8-6g2rgithub.com/ory/kratos@v1.0.01.3.1-0.20260320110106-9d7085948039
LowGO-2023-1878stdlib@go1.20.51.19.11
LowALPINE-CVE-2023-2975openssl@3.1.1-r13.1.1-r2
LowGHSA-45gg-vh54-h5m9golang.org/x/crypto@v0.5.00.52.0
LowGO-2024-2963stdlib@go1.20.51.21.12
LowGO-2023-1702stdlib@go1.19.31.19.8
LowGHSA-5cv4-jp36-h3mwgolang.org/x/net@v0.8.00.55.0
LowDLA-3910-1e2fsprogs@1.46.2-21.46.2-2+deb11u1
LowGHSA-jgfp-53c3-624wk8s.io/kubernetes@v1.25.41.29.14
LowGHSA-xw73-rw38-6vjcgithub.com/docker/docker@v20.10.24+incompatible24.0.9
LowDSA-5678-1glibc@2.31-13+deb11u62.31-13+deb11u10
LowGHSA-j5w8-q4qc-rx2xgolang.org/x/crypto@v0.5.00.45.0
LowDLA-4267-1gnutls28@3.7.1-5+deb11u33.7.1-5+deb11u8
LowDLA-4063-1gnutls28@3.7.1-5+deb11u33.7.1-5+deb11u7
LowGO-2023-2375stdlib@go1.19.31.20.0
LowGHSA-vvgc-356p-c3xwgolang.org/x/net@v0.8.00.38.0
LowGO-2023-1569stdlib@go1.19.31.19.6
LowGHSA-qc2q-p7wx-3px3google.golang.org/grpc@v1.54.01.83.1
LowGHSA-v6v8-xj6m-xwqhgithub.com/hashicorp/go-retryablehttp@v0.7.20.7.7
LowGO-2023-2382stdlib@go1.20.51.20.12
LowGO-2022-1143stdlib@go1.19.31.18.9

Indexed versions

VersionPublishedApp versionVulnerabilitiesRadar Score
0.34.7latest1 year agov2.2.02241195838,677

The latest version and the previous major, as selected nightly from the repository’s index.

README badge
[![Radar Score](https://charts.stackradar.io/badge/galoymoney/galoy.svg)](https://charts.stackradar.io/charts/galoymoney/galoy)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.

helm v3.16.4 · syft 1.42.1 · rendered 7 Sept 2026 · scanned 14 Sept 2026 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.