kubecost 0.37.5 Helm chart

Name: kubecost Helm chart 0.37.5: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

mesosphere-stable

Scored 15 Sept 2026

Kubecost

Version 0.37.5 1 year agodeploys tag 1.28.0 2Artifact Hub

kubecost 0.37.5 deploys 9 container images: kiwigrid/k8s-sidecar, grafana/grafana, quay.io/prometheus/alertmanager, quay.io/prometheus-operator/prometheus-config-reloader and 5 more. Across them, 1,626 findings — 2 critical, 24 high — 2 on CISA KEV. The highest contribution is DEBIAN-CVE-2025-48384 in git 1:2.39.5-0+deb12u1, fixed in 1:2.39.5-0+deb12u3.

Radar Score

17,7552242661,334

1,626 findings over 9 of 9 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

9 images

Image	Tag	Vulnerabilities	Radar Score
kiwigrid/k8s-sidecar×2	1.28.0	022045	878
grafana/grafana	9.4.7	0741205	3,018
quay.io/prometheus/alertmanager	v0.27.0	0110103	1,031
quay.io/prometheus-operator/prometheus-config-reloader	v0.69.1	0211107	1,152
quay.io/prometheus/prometheus	v2.55.0	0011108	1,008
quay.io/thanos/thanos	v0.36.1	0010107	998
gcr.io/kubecost1/cost-model	prod-1.108.1	1659277	3,857
gcr.io/kubecost1/frontend	prod-1.108.1	032017	753
bitnamilegacy/kubectl×3	1.30.5	1384365	5,060

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

603 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	DEBIAN-CVE-2026-18508	tar@1.34+dfsg-1.2+deb12u1	no fix listed
Low	DEBIAN-CVE-2025-68972	gnupg2@2.2.40-1.1	no fix listed
Low	DEBIAN-CVE-2026-0992	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6
Low	GHSA-37cx-329c-33x3	github.com/go-git/go-git/v5@v5.4.2	5.16.5
Low	DEBIAN-CVE-2026-89160	pcre2@10.42-1	10.42-1+deb12u1
Low	DEBIAN-CVE-2022-3219	gnupg2@2.2.40-1.1	no fix listed
Low	ALPINE-CVE-2026-41080	expat@2.6.3-r0	2.8.1-r0
Low	DEBIAN-CVE-2026-41080	expat@2.5.0-1+deb12u1	no fix listed
Low	DEBIAN-CVE-2023-4016	procps@2:4.0.2-3	no fix listed
Low	GHSA-crvv-6w6h-cv34	github.com/grafana/grafana@v9.4.7	11.6.2
Low	ALPINE-CVE-2025-69418	openssl@3.3.2-r0	3.3.6-r0
Low	DEBIAN-CVE-2025-69418	openssl@3.0.14-1~deb12u2	3.0.18-1~deb12u2
Low	DEBIAN-CVE-2007-5686	shadow@1:4.13+dfsg1-1+b1	no fix listed
Low	GO-2026-5024	golang.org/x/sys@v0.22.0	0.44.0
Low	GO-2026-6179	golang.org/x/mod@v0.14.0	0.40.0
Low	DEBIAN-CVE-2026-18477	tar@1.34+dfsg-1.2+deb12u1	no fix listed
Low	GHSA-xhgw-qwwf-pg32	github.com/cilium/ebpf@v0.11.0	0.22.0
Low	GO-2023-2153	google.golang.org/grpc@v1.45.0	1.56.3
Low	GO-2026-4760	github.com/russellhaering/gosaml2@v0.9.1	0.11.0
Low	GO-2026-4764	github.com/russellhaering/gosaml2@v0.9.1	0.11.0
Low	GO-2026-5693	github.com/go-git/go-git/v5@v5.4.2	5.19.1
Low	GO-2026-5841	github.com/klauspost/compress@v1.16.7	1.18.7
Low	GO-2026-5932	golang.org/x/crypto@v0.14.0	no fix listed
Low	GO-2026-6061	google.golang.org/grpc@v1.63.2	1.82.1
Low	GO-2026-6278	github.com/gorilla/websocket@v1.5.0	1.5.3
Low	USN-6541-2	glibc@2.35-0ubuntu3.5	2.35-0ubuntu3.6
Low	USN-6663-1	openssl@3.0.2-0ubuntu1.12	3.0.2-0ubuntu1.15
Low	USN-7034-1	ca-certificates@20230311ubuntu0.22.04.1	20240203~22.04.1
Low	USN-7412-2	gnupg2@2.2.27-3ubuntu2.1	2.2.27-3ubuntu2.4
Low	USN-8091-1	util-linux@2.37.2-4ubuntu3	2.37.2-4ubuntu3.5
Low	USN-8436-1	ca-certificates@20230311ubuntu0.22.04.1	20260601~22.04.1
Low	USN-8543-2	wget@1.21.2-2ubuntu1	1.21.2-2ubuntu1.5
Low	USN-8625-1	openssl@3.0.2-0ubuntu1.12	3.0.2-0ubuntu1.26
Low	USN-8688-1	pam@1.4.0-11ubuntu2.3	1.4.0-11ubuntu2.8
Low	ALPINE-CVE-2025-46394	busybox@1.36.1-r29	1.36.1-r31
Low	DEBIAN-CVE-2026-40228	systemd@252.30-1~deb12u2	no fix listed
Low	GHSA-4vq8-7jfc-9cvp	github.com/docker/docker@v27.2.0+incompatible	28.0.0
Low	GHSA-66c4-2g2v-54qw	github.com/grafana/grafana@v9.4.7	no fix listed
Low	DEBIAN-CVE-2025-6170	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3
Low	GHSA-m7cr-m3pv-hgrp	github.com/go-git/go-git/v5@v5.4.2	5.19.1
Low	DEBIAN-CVE-2026-57062	gnupg2@2.2.40-1.1	no fix listed
Low	GHSA-gm2x-2g9h-ccm8	github.com/go-git/go-git/v5@v5.4.2	5.17.1
Low	GHSA-6vgw-5pg2-w6jp	pip@24.2	26.0
Low	DEBIAN-CVE-2026-53910	diffutils@1:3.8-4	no fix listed
Low	DEBIAN-CVE-2026-86137	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	DEBIAN-CVE-2026-86141	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	ALPINE-CVE-2026-24515	expat@2.6.3-r0	2.7.4-r0
Low	DEBIAN-CVE-2026-24515	expat@2.5.0-1+deb12u1	no fix listed
Low	ALPINE-CVE-2024-58251	busybox@1.36.1-r29	1.36.1-r31
Low	UBUNTU-CVE-2026-89162	pcre2@10.39-3ubuntu0.1	no fix listed

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.37.5latest	1 year ago	1.28.0	2242661,334	17,755

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/mesosphere-stable/kubecost.svg)](https://charts.stackradar.io/charts/mesosphere-stable/kubecost)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.