prometheus-operator Helm chart

Name: prometheus-operator Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

mesosphere

Scored 14 Sept 2026

prometheus-operator collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

Latest 12.11.13 6 months agoapp version 0.44.0 0Artifact Hub

prometheus-operator 12.11.13 deploys 8 container images: quay.io/prometheus/node-exporter, quay.io/kiwigrid/k8s-sidecar, grafana/grafana, registry.k8s.io/kube-state-metrics/kube-state-metrics and 4 more. Across the 7 measured, 972 findings — 1 critical, 19 high — 3 on CISA KEV. The highest contribution is ALPINE-CVE-2021-3711 in openssl 1.1.1i-r0, fixed in 1.1.1l-r0. Chart.yaml declares kubeVersion >=1.16.0-0; rendered for Kubernetes 1.16.0.

Radar Score

11,689119181771

972 findings over 7 of 8 images measured

KEV ×3 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

8 images

Image	Tag	Vulnerabilities	Radar Score
quay.io/prometheus/node-exporter	v1.0.1	0327163	2,188
quay.io/kiwigrid/k8s-sidecar×2	2.5.0	011951	878
grafana/grafana	12.3.3	0036153	2,075
registry.k8s.io/kube-state-metrics/kube-state-metrics	v2.18.0	00665	618
quay.io/prometheus-operator/prometheus-operator	v0.44.0	0331164	2,252
apteno/alpine-jq	2021-01-19	19299	1,345
bitnami/kubectl×4	1.19.7	—	unmeasured
jettech/kube-webhook-certgen×2	v1.5.0	0333166	2,333

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Medium findings

101 distinct across the version’s images

Medium: findings whose contribution to the Radar Score is 15–39. Show every band

Severity	Advisory	Package	Fixed in
Medium	GHSA-x744-4wpc-v9h2	github.com/moby/moby@v27.5.1+incompatible	29.3.1
Medium	GO-2024-2687	stdlib@go1.14.12	1.21.9
Medium	GHSA-5cgq-3rg8-m6cv	golang.org/x/crypto@v0.45.0	0.52.0
Medium	DLA-3008-1	openssl@1.1.0l-1~deb9u1	1.1.0l-1~deb9u6
Medium	ALPINE-CVE-2021-22945	curl@7.74.0-r0	7.79.0-r0
Medium	DLA-2952-1	openssl@1.1.0l-1~deb9u1	1.1.0l-1~deb9u5
Medium	DLA-2563-1	openssl@1.1.0l-1~deb9u1	1.1.0l-1~deb9u3
Medium	DLA-2766-1	openssl@1.1.0l-1~deb9u1	1.1.0l-1~deb9u4
Medium	GHSA-83g2-8m93-v3w7	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0	0.0.0-20210520170846-37e1c6afe023
Medium	GHSA-cg3q-j54f-5p7p	github.com/prometheus/client_golang@v1.8.0	1.11.1
Medium	ALPINE-CVE-2026-45447	openssl@3.5.5-r0	3.5.7-r0
Medium	ALPINE-CVE-2022-28391	busybox@1.32.1-r0	1.32.1-r8
Medium	GHSA-v778-237x-gjrc	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.31.0
Medium	GHSA-c3h9-896r-86jm	github.com/gogo/protobuf@v1.3.1	1.3.2
Medium	ALPINE-CVE-2022-32205	curl@7.74.0-r0	7.79.1-r2
Medium	ALPINE-CVE-2021-36159	apk-tools@2.12.0-r4	2.12.6-r0
Medium	GHSA-vvpx-j8f3-3w6h	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0	0.7.0
Medium	ALPINE-CVE-2021-22946	curl@7.74.0-r0	7.79.0-r0
Medium	GHSA-hp87-p4gw-j4gq	gopkg.in/yaml.v3@v3.0.0-20200615113413-eeeca48fe776	3.0.1
Medium	GHSA-8c26-wmh5-6g9v	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.0.0-20220314234659-1baeb1ce4c0b
Medium	GHSA-4374-p667-p6c8	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0	0.17.0
Medium	ALPINE-CVE-2021-23841	openssl@1.1.1i-r0	1.1.1j-r0
Medium	ALPINE-CVE-2022-32208	curl@7.74.0-r0	7.79.1-r2
Medium	GHSA-69cg-p879-7622	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0	0.0.0-20220906165146-f3363e06e74c
Medium	GHSA-3vm4-22fp-5rfm	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.0.0-20201216223049-8b5274cf687f
Medium	ALPINE-CVE-2022-27775	curl@7.74.0-r0	7.79.1-r1
Medium	ALPINE-CVE-2022-27782	curl@7.74.0-r0	7.79.1-r2
Medium	ALPINE-CVE-2021-22922	curl@7.74.0-r0	7.78.0-r0
Medium	GHSA-p77j-4mvh-x3m3	google.golang.org/grpc@v1.78.0	1.79.3
Medium	ALPINE-CVE-2022-27781	curl@7.74.0-r0	7.79.1-r2
Medium	ALPINE-CVE-2021-42380	busybox@1.32.1-r0	1.32.1-r7
Medium	ALPINE-CVE-2022-22576	curl@7.74.0-r0	7.79.1-r1
Medium	ALPINE-CVE-2021-28831	busybox@1.32.1-r0	1.32.1-r4
Medium	ALPINE-CVE-2026-19931	curl@8.17.0-r1	8.22.0-r0
Medium	ALPINE-CVE-2025-11187	openssl@3.5.4-r0	3.5.5-r0
Medium	ALPINE-CVE-2022-27776	curl@7.74.0-r0	7.79.1-r1
Medium	ALPINE-CVE-2021-42379	busybox@1.32.1-r0	1.32.1-r7
Medium	ALPINE-CVE-2021-42381	busybox@1.32.1-r0	1.32.1-r7
Medium	ALPINE-CVE-2021-42385	busybox@1.32.1-r0	1.32.1-r7
Medium	ALPINE-CVE-2021-42378	busybox@1.32.1-r0	1.32.1-r7
Medium	ALPINE-CVE-2021-42382	busybox@1.32.1-r0	1.32.1-r7
Medium	ALPINE-CVE-2021-42384	busybox@1.32.1-r0	1.32.1-r7
Medium	ALPINE-CVE-2021-42386	busybox@1.32.1-r0	1.32.1-r7
Medium	ALPINE-CVE-2026-9079	curl@8.17.0-r1	8.22.0-r0
Medium	ALPINE-CVE-2026-63073	openssl@3.5.5-r0	3.5.8-r0
Medium	ALPINE-CVE-2021-42383	busybox@1.32.1-r0	1.32.1-r7
Medium	ALPINE-CVE-2026-10536	curl@8.17.0-r1	8.22.0-r0
Medium	GHSA-xrjj-mj9h-534m	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0	0.4.0
Medium	ALPINE-CVE-2021-22876	curl@7.74.0-r0	7.76.0-r0
Medium	GHSA-5rcv-m4m3-hfh7	golang.org/x/text@v0.3.2	0.3.3

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
12.11.13latest	6 months ago	0.44.0	119181771	11,689

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/mesosphere/prometheus-operator.svg)](https://charts.stackradar.io/charts/mesosphere/prometheus-operator)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.