vcluster-k8s Helm chart

Name: vcluster-k8s Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

loft

Scored 14 Sept 2026

vcluster - Virtual Kubernetes Clusters (k8s)

Latest 0.0.0-ci.3 3 years agoapp version 0.0.0-ci.3 2Artifact Hub

vcluster-k8s 0.0.0-ci.3 deploys 4 container images: registry.k8s.io/kube-apiserver, registry.k8s.io/kube-controller-manager, ghcr.io/loft-sh/vcluster and registry.k8s.io/etcd. Across the 3 measured, 526 findings — 0 critical, 11 high — 3 on CISA KEV. The highest contribution is GHSA-45x7-px36-x8w8 in golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4, fixed in 0.0.0-20231218163308-9d2ee975ef9f.

Radar Score

5,57001161454

526 findings over 3 of 4 images measured

KEV ×3 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

4 images

Image	Tag	Vulnerabilities	Radar Score
registry.k8s.io/kube-apiserver	v1.26.1	0420148	1,839
registry.k8s.io/kube-controller-manager	v1.26.1	0421148	1,855
ghcr.io/loft-sh/vcluster×2	0.0.0-ci.3	—	unmeasured
registry.k8s.io/etcd	3.5.6-0	0320158	1,876

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

174 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	GO-2026-4864	stdlib@go1.16.15	1.25.9
Low	GO-2025-3447	stdlib@go1.16.15	1.22.12
Low	GO-2026-4865	stdlib@go1.16.15	1.25.9
Low	GO-2026-4869	stdlib@go1.16.15	1.25.9
Low	GO-2026-4340	stdlib@go1.16.15	1.24.12
Low	GO-2025-4175	stdlib@go1.16.15	1.24.11
Low	GO-2026-4403	stdlib@go1.16.15	1.23.9
Low	GHSA-29wx-vh33-7x7r	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.1
Low	GO-2026-5025	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2	0.55.0
Low	GO-2026-4970	stdlib@go1.16.15	1.25.12
Low	GO-2022-0635	github.com/aws/aws-sdk-go@v1.44.116	no fix listed
Low	GO-2026-5027	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2	0.55.0
Low	GO-2026-5029	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2	0.55.0
Low	GO-2026-5030	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2	0.55.0
Low	GO-2026-4602	stdlib@go1.16.15	1.25.8
Low	GO-2026-5024	golang.org/x/sys@v0.0.0-20210615035016-665e8c7367d1	0.44.0
Low	DLA-3972-1	tzdata@2021a-1+deb11u8	2024b-0+deb11u1
Low	DLA-4085-1	tzdata@2021a-1+deb11u8	2025a-0+deb11u1
Low	DLA-4105-1	tzdata@2021a-1+deb11u8	2025b-0+deb11u1
Low	DLA-4403-1	tzdata@2021a-1+deb11u8	2025b-0+deb11u2
Low	GO-2023-2153	google.golang.org/grpc@v1.41.0	1.56.3
Low	GO-2026-5932	golang.org/x/crypto@v0.0.0-20220411220226-7b82a4e95df4	no fix listed
Low	GO-2026-6061	google.golang.org/grpc@v1.41.0	1.82.1
Low	GO-2026-6278	github.com/gorilla/websocket@v1.4.2	1.5.3

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.0.0-ci.3latest	3 years ago	0.0.0-ci.3	01161454	5,570

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/loft/vcluster-k8s.svg)](https://charts.stackradar.io/charts/loft/vcluster-k8s)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.