kubecost Helm chart

Name: kubecost Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

mesosphere-stable

Scored 14 Sept 2026

Kubecost

Latest 0.37.5 1 year agodeploys tag 1.28.0 2Artifact Hub

kubecost 0.37.5 deploys 9 container images: kiwigrid/k8s-sidecar, grafana/grafana, quay.io/prometheus/alertmanager, quay.io/prometheus-operator/prometheus-config-reloader and 5 more. Across them, 1,619 findings — 3 critical, 23 high — 2 on CISA KEV. The highest contribution is DEBIAN-CVE-2025-48384 in git 1:2.39.5-0+deb12u1, fixed in 1:2.39.5-0+deb12u3.

Radar Score

17,6933232651,328

1,619 findings over 9 of 9 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

9 images

Image	Tag	Vulnerabilities	Radar Score
kiwigrid/k8s-sidecar×2	1.28.0	112045	879
grafana/grafana	9.4.7	0741205	3,018
quay.io/prometheus/alertmanager	v0.27.0	0110103	1,031
quay.io/prometheus-operator/prometheus-config-reloader	v0.69.1	0211107	1,152
quay.io/prometheus/prometheus	v2.55.0	0011108	1,008
quay.io/thanos/thanos	v0.36.1	0010107	998
gcr.io/kubecost1/cost-model	prod-1.108.1	1659270	3,818
gcr.io/kubecost1/frontend	prod-1.108.1	032017	753
bitnamilegacy/kubectl×3	1.30.5	1383366	5,036

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

794 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	GHSA-fw9c-75hh-89p6	github.com/grafana/grafana@v9.4.7	no fix listed
Low	DEBIAN-CVE-2024-56406	perl@5.36.0-7+deb12u1	5.36.0-7+deb12u2
Low	GHSA-89gr-r52h-f8rx	golang.org/x/crypto@v0.14.0	0.52.0
Low	UBUNTU-CVE-2024-37370	krb5@1.19.2-2ubuntu0.3	1.19.2-2ubuntu0.4
Low	GHSA-x2w4-c67p-g44j	github.com/grafana/grafana@v9.4.7	9.4.12
Low	GHSA-qc2g-gmh6-95p4	k8s.io/kubernetes@v0.0.0-20240912001154-74e84a90c725	1.24.15
Low	GHSA-jppx-rxg9-jmrx	golang.org/x/crypto@v0.14.0	0.52.0
Low	GHSA-mh63-6h87-95cp	github.com/golang-jwt/jwt/v5@v5.0.0	5.2.2
Low	GHSA-mh63-6h87-95cp	github.com/golang-jwt/jwt/v4@v4.4.3	4.5.2
Low	GHSA-r9px-m959-cxf4	github.com/go-git/go-git/v5@v5.4.2	5.13.0
Low	DEBIAN-CVE-2026-9076	openssl@3.0.14-1~deb12u2	3.0.20-1~deb12u2
Low	DEBIAN-CVE-2026-82209	curl@7.88.1-10+deb12u7	no fix listed
Low	DEBIAN-CVE-2026-66032	libssh2@1.10.0-3+b1	1.10.0-3+deb12u1
Low	GHSA-mw99-9chc-xw7r	github.com/go-git/go-git/v5@v5.4.2	5.11.0
Low	UBUNTU-CVE-2024-10524	wget@1.21.2-2ubuntu1	no fix listed
Low	DEBIAN-CVE-2026-12087	perl@5.36.0-7+deb12u1	no fix listed
Low	GHSA-vv39-3w5q-974q	k8s.io/kubernetes@v0.0.0-20240912001154-74e84a90c725	1.29.13
Low	GHSA-vp52-pcj8-j9qc	google.golang.org/grpc@v1.63.2	1.83.1
Low	GHSA-h7wq-jj8r-qm7p	k8s.io/kubernetes@v0.0.0-20240912001154-74e84a90c725	1.27.0-alpha.1
Low	DEBIAN-CVE-2026-32316	jq@1.6-2.1	1.6-2.1+deb12u2
Low	DEBIAN-CVE-2025-32415	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u2
Low	DEBIAN-CVE-2026-0915	glibc@2.36-9+deb12u8	2.36-9+deb12u14
Low	DEBIAN-CVE-2025-4802	glibc@2.36-9+deb12u8	2.36-9+deb12u11
Low	DEBIAN-CVE-2023-50495	ncurses@6.4-4	no fix listed
Low	DEBIAN-CVE-2026-13608	curl@7.88.1-10+deb12u7	no fix listed
Low	DEBIAN-CVE-2026-5773	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u15
Low	GHSA-r277-6w6q-xmqw	github.com/getkin/kin-openapi@v0.107.0	0.144.0
Low	DEBIAN-CVE-2026-63072	openssl@3.0.14-1~deb12u2	no fix listed
Low	DEBIAN-CVE-2026-40355	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u5
Low	GHSA-8wv5-x4w7-5gww	github.com/apache/thrift@v0.16.0	0.24.0
Low	DEBIAN-CVE-2026-40356	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u5
Low	DEBIAN-CVE-2026-45445	openssl@3.0.14-1~deb12u2	3.0.20-1~deb12u2
Low	DEBIAN-CVE-2026-85091	zlib@1:1.2.13.dfsg-1	no fix listed
Low	UBUNTU-CVE-2021-31879	wget@1.21.2-2ubuntu1	no fix listed
Low	UBUNTU-CVE-2024-33600	glibc@2.35-0ubuntu3.5	2.35-0ubuntu3.8
Low	GO-2023-2102	stdlib@go1.20.1	1.20.10
Low	ALPINE-CVE-2023-0466	openssl@3.0.8-r0	3.0.8-r3
Low	DEBIAN-CVE-2026-80230	curl@7.88.1-10+deb12u7	no fix listed
Low	ALPINE-CVE-2023-0465	openssl@3.0.8-r0	3.0.8-r2
Low	DEBIAN-CVE-2026-42013	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7
Low	DEBIAN-CVE-2026-0861	glibc@2.36-9+deb12u8	2.36-9+deb12u14
Low	GO-2024-2661	github.com/grafana/grafana@v9.4.7	no fix listed
Low	DEBIAN-CVE-2026-3833	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7
Low	DEBIAN-CVE-2024-2236	libgcrypt20@1.10.1-3	no fix listed
Low	ALPINE-CVE-2026-31789	openssl@3.3.2-r0	3.3.7-r0
Low	DEBIAN-CVE-2026-31789	openssl@3.0.14-1~deb12u2	3.0.19-1~deb12u2
Low	ALPINE-CVE-2025-69419	openssl@3.3.2-r0	3.3.6-r0
Low	DEBIAN-CVE-2025-69419	openssl@3.0.14-1~deb12u2	3.0.18-1~deb12u2
Low	DEBIAN-CVE-2023-45322	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u2
Low	DEBIAN-CVE-2025-48060	jq@1.6-2.1	1.6-2.1+deb12u1

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.37.5latest	1 year ago	1.28.0	3232651,328	17,693

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/mesosphere-stable/kubecost.svg)](https://charts.stackradar.io/charts/mesosphere-stable/kubecost)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.