kubiya-runner 0.9.4 Helm chart

Name: kubiya-runner Helm chart 0.9.4: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

kubiya-helm-charts

Scored 14 Sept 2026

A Helm chart for Kubiya Runner deployment

Version 0.9.4 10 months agodeploys tag v1.5.1 0Artifact Hub

kubiya-runner 0.9.4 deploys 9 container images: grafana/alloy, ghcr.io/jimmidyson/configmap-reload, registry.k8s.io/kube-state-metrics/kube-state-metrics, ghcr.io/kubiyabot/agent-manager and 5 more. Across them, 2,020 findings — 1 critical, 8 high — 2 on CISA KEV. The highest contribution is DEBIAN-CVE-2025-48384 in git 1:2.39.5-0+deb12u1, fixed in 1:2.39.5-0+deb12u3. Chart.yaml declares kubeVersion >=1.19.0-0; rendered for Kubernetes 1.19.0.

Radar Score

20,204182701,738

2,020 findings over 9 of 9 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

9 images

Image	Tag	Vulnerabilities	Radar Score
grafana/alloy	v1.5.1	0137276	2,987
ghcr.io/jimmidyson/configmap-reload	v0.12.0	00275	588
registry.k8s.io/kube-state-metrics/kube-state-metrics	v2.14.0	00887	786
ghcr.io/kubiyabot/agent-manager	v0.4.13	0383479	5,951
ghcr.io/kubiyabot/kubiya-operator	runner_v2	00877	725
ghcr.io/kubiyabot/tool-manager	0.5.8	0116153	1,582
ghcr.io/kubiyabot/sdk-py	v1.20.0	01934	547
ghcr.io/kubiyabot/workflow-engine	v1.46.2	0017142	1,497
ghcr.io/kubiyabot/kubernetes	1.32.0	1290415	5,541

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

793 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	DEBIAN-CVE-2025-15367	python3.13@3.13.5-2	no fix listed
Low	GHSA-hrxh-6v49-42gf	google.golang.org/grpc@v1.73.0	1.82.1
Low	DSA-5850-1	git@1:2.39.5-0+deb12u1	1:2.39.5-0+deb12u2
Low	DEBIAN-CVE-2026-21714	nodejs@18.20.8-1nodesource1	20.19.2+dfsg-1+deb13u2
Low	DEBIAN-CVE-2026-3783	curl@8.14.1-2	8.14.1-2+deb13u4
Low	DEBIAN-CVE-2026-4873	curl@8.14.1-2	8.14.1-2+deb13u4
Low	GO-2024-2609	stdlib@go1.21.5	1.21.8
Low	DEBIAN-CVE-2026-59999	openssh@1:10.0p1-7	no fix listed
Low	DEBIAN-CVE-2026-34743	xz-utils@5.8.1-1	5.8.1-1+deb13u1
Low	GO-2024-3107	stdlib@go1.21.5	1.22.7
Low	DEBIAN-CVE-2026-5704	tar@1.35+dfsg-3.1	no fix listed
Low	GHSA-pq67-6m6q-mj2v	urllib3@2.2.3	2.5.0
Low	DEBIAN-CVE-2026-3441	binutils@2.44-3	no fix listed
Low	DEBIAN-CVE-2026-35387	openssh@1:10.0p1-7	1:10.0p1-7+deb13u3
Low	DEBIAN-CVE-2026-3184	util-linux@2.41-5	no fix listed
Low	GHSA-cp6g-7hqx-qxhp	go.mongodb.org/mongo-driver@v1.14.0	1.17.7
Low	GHSA-xmrv-pmrh-hhx2	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.0	1.7.8
Low	GHSA-xmrv-pmrh-hhx2	github.com/aws/aws-sdk-go-v2/service/s3@v1.49.0	1.97.3
Low	DEBIAN-CVE-2026-58055	nghttp2@1.64.0-1.1	no fix listed
Low	DEBIAN-CVE-2026-7010	perl@5.40.1-6	5.40.1-6+deb13u1
Low	DEBIAN-CVE-2026-19487	perl@5.40.1-6	no fix listed
Low	DEBIAN-CVE-2023-52426	expat@2.5.0-1+deb12u1	no fix listed
Low	GHSA-9m57-25v3-79x9	golang.org/x/crypto@v0.40.0	0.52.0
Low	GHSA-pwhc-rpq9-4c8w	github.com/containerd/containerd/v2@v2.0.2	2.0.7
Low	GHSA-pwhc-rpq9-4c8w	github.com/containerd/containerd@v1.7.23	1.7.29
Low	GHSA-497x-rrr9-68jp	github.com/grafana/loki/v3@v3.0.0-20240617182007-6c33561108ad	3.6.4
Low	GHSA-65pc-fj4g-8rjx	idna@3.10	3.15
Low	DEBIAN-CVE-2026-89158	pcre2@10.46-1~deb13u1	10.46-1~deb13u2
Low	GHSA-x86f-5xw2-fm2r	github.com/docker/docker@v28.3.2+incompatible	no fix listed
Low	DEBIAN-CVE-2025-27587	openssl@3.0.15-1~deb12u1	no fix listed
Low	DEBIAN-CVE-2026-42769	openssl@3.5.1-1+deb13u1	3.5.6-1~deb13u2
Low	DEBIAN-CVE-2013-4392	systemd@257.8-1~deb13u2	no fix listed
Low	GHSA-vw47-mr44-3jf9	k8s.io/kubernetes@v0.0.0-20241211175915-70d3cc986aa8	no fix listed
Low	GO-2023-2186	stdlib@go1.21.1	1.20.11
Low	GHSA-gxhx-2686-5h9g	github.com/slack-go/slack@v0.17.2	0.23.1
Low	GO-2024-3333	golang.org/x/net@v0.17.0	0.33.0
Low	GHSA-9h8m-3fm2-qjrq	go.opentelemetry.io/otel/sdk@v1.37.0	1.40.0
Low	DEBIAN-CVE-2026-78408	util-linux@2.41-5	no fix listed
Low	GHSA-jpcw-4wr7-c3vq	github.com/getkin/kin-openapi@v0.127.0	0.144.0
Low	DEBIAN-CVE-2026-21717	nodejs@18.20.8-1nodesource1	20.19.2+dfsg-1+deb13u2
Low	DEBIAN-CVE-2026-41989	libgcrypt20@1.11.0-7	1.11.0-7+deb13u1
Low	GHSA-389r-gv7p-r3rp	github.com/go-git/go-git/v5@v5.11.0	5.19.0
Low	GHSA-48p4-8xcf-vxj5	urllib3@2.2.3	2.5.0
Low	GHSA-3jxr-9vmj-r5cp	brace-expansion@2.0.1	2.1.2
Low	DEBIAN-CVE-2024-11053	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u10
Low	GHSA-2464-8j7c-4cjm	github.com/go-viper/mapstructure/v2@v2.2.1	2.4.0
Low	GHSA-8cfg-vx93-jvxw	k8s.io/kubernetes@v0.0.0-20241211175915-70d3cc986aa8	1.20.0-alpha.2
Low	UBUNTU-CVE-2025-5702	glibc@2.39-0ubuntu8.3	2.39-0ubuntu8.5
Low	GO-2024-3105	stdlib@go1.21.5	1.22.7
Low	DEBIAN-CVE-2026-49839	jq@1.6-2.1	1.6-2.1+deb12u2

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.9.4latest	10 months ago	v1.5.1	182701,738	20,204

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/kubiya-helm-charts/kubiya-runner.svg)](https://charts.stackradar.io/charts/kubiya-helm-charts/kubiya-runner)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.