kubecost Helm chart

Name: kubecost Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

mesosphere-stable

Scored 14 Sept 2026

Kubecost

Latest 0.37.5 1 year agodeploys tag 1.28.0 2Artifact Hub

kubecost 0.37.5 deploys 9 container images: kiwigrid/k8s-sidecar, grafana/grafana, quay.io/prometheus/alertmanager, quay.io/prometheus-operator/prometheus-config-reloader and 5 more. Across them, 1,619 findings — 3 critical, 23 high — 2 on CISA KEV. The highest contribution is DEBIAN-CVE-2025-48384 in git 1:2.39.5-0+deb12u1, fixed in 1:2.39.5-0+deb12u3.

Radar Score

17,6933232651,328

1,619 findings over 9 of 9 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

9 images

Image	Tag	Vulnerabilities	Radar Score
kiwigrid/k8s-sidecar×2	1.28.0	112045	879
grafana/grafana	9.4.7	0741205	3,018
quay.io/prometheus/alertmanager	v0.27.0	0110103	1,031
quay.io/prometheus-operator/prometheus-config-reloader	v0.69.1	0211107	1,152
quay.io/prometheus/prometheus	v2.55.0	0011108	1,008
quay.io/thanos/thanos	v0.36.1	0010107	998
gcr.io/kubecost1/cost-model	prod-1.108.1	1659270	3,818
gcr.io/kubecost1/frontend	prod-1.108.1	032017	753
bitnamilegacy/kubectl×3	1.30.5	1383366	5,036

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

794 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	DEBIAN-CVE-2026-4873	curl@7.88.1-10+deb12u7	no fix listed
Low	GO-2024-2609	stdlib@go1.21.4	1.21.8
Low	ALPINE-CVE-2026-34743	xz@5.6.2-r0	5.8.3-r0
Low	DEBIAN-CVE-2026-34743	xz-utils@5.4.1-0.2	5.4.1-1+deb12u1
Low	GO-2024-2851	github.com/grafana/grafana@v9.4.7	no fix listed
Low	GO-2024-3107	stdlib@go1.21.4	1.22.7
Low	DEBIAN-CVE-2026-5704	tar@1.34+dfsg-1.2+deb12u1	no fix listed
Low	GO-2024-2856	github.com/grafana/grafana@v9.4.7	no fix listed
Low	GO-2023-1751	stdlib@go1.20.1	1.19.9
Low	GO-2023-1753	stdlib@go1.20.1	1.19.9
Low	ALPINE-CVE-2023-42365	busybox@1.36.1-r5	1.36.1-r7
Low	GHSA-hwqm-qvj9-4jr2	github.com/russellhaering/gosaml2@v0.9.1	0.11.0
Low	GHSA-pq67-6m6q-mj2v	urllib3@2.2.3	2.5.0
Low	DEBIAN-CVE-2026-3184	util-linux@2.38.1-5+deb12u1	no fix listed
Low	GHSA-cp6g-7hqx-qxhp	go.mongodb.org/mongo-driver@v1.12.0	1.17.7
Low	GHSA-xmrv-pmrh-hhx2	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10	1.7.8
Low	GHSA-xmrv-pmrh-hhx2	github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0	1.97.3
Low	DEBIAN-CVE-2026-58055	nghttp2@1.52.0-1+deb12u1	no fix listed
Low	GO-2025-3814	github.com/grafana/grafana@v9.4.7	no fix listed
Low	ALPINE-CVE-2024-6874	curl@8.5.0-r0	8.9.0-r0
Low	DEBIAN-CVE-2026-7010	perl@5.36.0-7+deb12u1	no fix listed
Low	DEBIAN-CVE-2026-19487	perl@5.36.0-7+deb12u1	no fix listed
Low	ALPINE-CVE-2023-52426	expat@2.5.0-r1	2.6.0-r0
Low	DEBIAN-CVE-2023-52426	expat@2.5.0-1+deb12u1	no fix listed
Low	GHSA-9m57-25v3-79x9	golang.org/x/crypto@v0.14.0	0.52.0
Low	GHSA-65pc-fj4g-8rjx	idna@3.10	3.15
Low	DEBIAN-CVE-2026-89158	pcre2@10.42-1	10.42-1+deb12u1
Low	GHSA-x86f-5xw2-fm2r	github.com/docker/docker@v27.2.0+incompatible	no fix listed
Low	GO-2023-2041	stdlib@go1.20.1	1.20.8
Low	DEBIAN-CVE-2025-27587	openssl@3.0.14-1~deb12u2	no fix listed
Low	GHSA-vffh-x6r8-xx99	github.com/prometheus/prometheus@v0.47.2	0.311.2-0.20260410083055-07c6232d159b
Low	GO-2023-2043	stdlib@go1.20.1	1.20.8
Low	DEBIAN-CVE-2013-4392	systemd@252.30-1~deb12u2	no fix listed
Low	GHSA-vw47-mr44-3jf9	k8s.io/kubernetes@v0.0.0-20240912001154-74e84a90c725	no fix listed
Low	GO-2023-2186	stdlib@go1.20.1	1.20.11
Low	GO-2024-2848	github.com/grafana/grafana@v9.4.7	no fix listed
Low	GO-2024-3333	golang.org/x/net@v0.23.0	0.33.0
Low	GHSA-9h8m-3fm2-qjrq	go.opentelemetry.io/otel/sdk@v1.27.0	1.40.0
Low	DEBIAN-CVE-2026-78408	util-linux@2.38.1-5+deb12u1	no fix listed
Low	GHSA-jpcw-4wr7-c3vq	github.com/getkin/kin-openapi@v0.107.0	0.144.0
Low	DEBIAN-CVE-2026-41989	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1
Low	GHSA-389r-gv7p-r3rp	github.com/go-git/go-git/v5@v5.4.2	5.19.0
Low	GHSA-48p4-8xcf-vxj5	urllib3@2.2.3	2.5.0
Low	ALPINE-CVE-2024-11053	curl@8.5.0-r0	8.11.1-r0
Low	DEBIAN-CVE-2024-11053	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u10
Low	GHSA-8cfg-vx93-jvxw	k8s.io/kubernetes@v0.0.0-20240912001154-74e84a90c725	1.20.0-alpha.2
Low	GO-2024-3105	stdlib@go1.21.4	1.22.7
Low	GO-2024-2867	github.com/grafana/grafana@v9.4.7	no fix listed
Low	DEBIAN-CVE-2026-49839	jq@1.6-2.1	1.6-2.1+deb12u2
Low	UBUNTU-CVE-2026-13595	util-linux@2.37.2-4ubuntu3	2.37.2-4ubuntu3.6

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.37.5latest	1 year ago	1.28.0	3232651,328	17,693

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/mesosphere-stable/kubecost.svg)](https://charts.stackradar.io/charts/mesosphere-stable/kubecost)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.