prometheus-operator Helm chart

Name: prometheus-operator Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

mesosphere

Scored 14 Sept 2026

prometheus-operator collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

Latest 12.11.13 6 months agoapp version 0.44.0 0Artifact Hub

prometheus-operator 12.11.13 deploys 8 container images: quay.io/prometheus/node-exporter, quay.io/kiwigrid/k8s-sidecar, grafana/grafana, registry.k8s.io/kube-state-metrics/kube-state-metrics and 4 more. Across the 7 measured, 972 findings — 1 critical, 19 high — 3 on CISA KEV. The highest contribution is ALPINE-CVE-2021-3711 in openssl 1.1.1i-r0, fixed in 1.1.1l-r0. Chart.yaml declares kubeVersion >=1.16.0-0; rendered for Kubernetes 1.16.0.

Radar Score

11,689119181771

972 findings over 7 of 8 images measured

KEV ×3 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

8 images

Image	Tag	Vulnerabilities	Radar Score
quay.io/prometheus/node-exporter	v1.0.1	0327163	2,188
quay.io/kiwigrid/k8s-sidecar×2	2.5.0	011951	878
grafana/grafana	12.3.3	0036153	2,075
registry.k8s.io/kube-state-metrics/kube-state-metrics	v2.18.0	00665	618
quay.io/prometheus-operator/prometheus-operator	v0.44.0	0331164	2,252
apteno/alpine-jq	2021-01-19	19299	1,345
bitnami/kubectl×4	1.19.7	—	unmeasured
jettech/kube-webhook-certgen×2	v1.5.0	0333166	2,333

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Medium findings

101 distinct across the version’s images

Medium: findings whose contribution to the Radar Score is 15–39. Show every band

Severity	Advisory	Package	Fixed in
Medium	GHSA-h86h-8ppg-mxmh	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0	0.0.0-20210428140749-89ef3d95e781
Medium	ALPINE-CVE-2021-22925	curl@7.74.0-r0	7.78.0-r0
Medium	ALPINE-CVE-2022-2097	openssl@1.1.1i-r0	1.1.1q-r0
Medium	ALPINE-CVE-2021-30139	apk-tools@2.12.0-r4	2.12.5-r0
Medium	ALPINE-CVE-2026-18924	curl@8.17.0-r1	8.22.0-r0
Medium	GHSA-69ch-w2m2-3vjp	golang.org/x/text@v0.3.3	0.3.8
Medium	ALPINE-CVE-2026-11856	curl@8.17.0-r1	8.22.0-r0
Medium	GO-2022-0433	stdlib@go1.14.12	1.17.9
Medium	ALPINE-CVE-2026-8925	curl@8.17.0-r1	8.22.0-r0
Medium	ALPINE-CVE-2026-18798	openssl@3.5.5-r0	3.5.8-r0
Medium	ALPINE-CVE-2021-22947	curl@7.74.0-r0	7.79.0-r0
Medium	ALPINE-CVE-2022-30065	busybox@1.32.1-r0	1.32.1-r9
Medium	GHSA-ppp9-7jff-5vj2	golang.org/x/text@v0.3.3	0.3.7
Medium	GHSA-xgrm-4fwx-7qm8	github.com/jackc/pgx/v5@v5.8.0	5.9.0
Medium	ALPINE-CVE-2026-63076	openssl@3.5.5-r0	3.5.8-r0
Medium	GHSA-8r3f-844c-mc37	google.golang.org/protobuf@v1.25.0	1.33.0
Medium	GHSA-9jj7-4m8r-rfcm	github.com/jackc/pgx/v5@v5.8.0	5.9.0
Medium	GHSA-x527-x647-q7gg	golang.org/x/crypto@v0.45.0	0.52.0
Medium	ALPINE-CVE-2026-42764	openssl@3.5.5-r0	3.5.7-r0
Medium	GHSA-wf45-q9ch-q8gh	github.com/apache/thrift@v0.22.0	0.23.0
Medium	GHSA-gwc9-m7rh-j2ww	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.0.0-20211202192323-5770296d904e
Medium	GHSA-vgwf-h737-ff37	golang.org/x/crypto@v0.45.0	0.52.0
Medium	ALPINE-CVE-2026-34182	openssl@3.5.5-r0	3.5.7-r0
Medium	GHSA-f5wc-c3c7-36mc	golang.org/x/crypto@v0.45.0	0.52.0
Medium	DLA-2492-1	openssl@1.1.0l-1~deb9u1	1.1.0l-1~deb9u2
Medium	GO-2021-0243	stdlib@go1.14.12	1.15.14
Medium	GO-2022-0273	stdlib@go1.14.12	1.16.8
Medium	ALPINE-CVE-2026-34183	openssl@3.5.5-r0	3.5.7-r0
Medium	GHSA-p782-xgp4-8hr8	golang.org/x/sys@v0.0.0-20201015000850-e3ed0017c211	0.0.0-20220412211240-33da011f77ad
Medium	ALPINE-CVE-2026-31790	openssl@3.5.5-r0	3.5.6-r0
Medium	ALPINE-CVE-2026-34180	openssl@3.5.5-r0	3.5.7-r0
Medium	ALPINE-CVE-2026-7383	openssl@3.5.5-r0	3.5.7-r0
Medium	ALPINE-CVE-2026-8924	curl@8.17.0-r1	8.22.0-r0
Medium	ALPINE-CVE-2026-14457	openssl@3.5.5-r0	3.5.8-r0
Medium	GHSA-4f99-4q7p-p3gh	github.com/sirupsen/logrus@v1.4.2	1.8.3
Medium	GHSA-hqxw-f8mx-cpmw	github.com/docker/distribution@v2.7.1+incompatible	2.8.2-beta.1
Medium	GHSA-rm3j-f69w-wqmq	golang.org/x/crypto@v0.45.0	0.52.0
Medium	ALPINE-CVE-2026-80231	curl@8.17.0-r1	8.22.0-r0
Medium	GHSA-hcg3-q754-cr77	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.35.0
Medium	ALPINE-CVE-2026-80229	curl@8.17.0-r1	8.22.0-r0
Medium	ALPINE-CVE-2026-8927	curl@8.17.0-r1	8.22.0-r0
Medium	ALPINE-CVE-2026-28388	openssl@3.5.5-r0	3.5.6-r0
Medium	ALPINE-CVE-2025-69421	openssl@3.5.4-r0	3.5.5-r0
Medium	GO-2022-1144	stdlib@go1.14.12	1.18.9
Medium	GHSA-6v2p-p543-phr9	golang.org/x/oauth2@v0.0.0-20200902213428-5d25da1a8d43	0.27.0
Medium	ALPINE-CVE-2026-28387	openssl@3.5.5-r0	3.5.6-r0
Medium	GHSA-58pv-8j8x-9vj2	jaraco-context@5.3.0	6.1.0
Medium	GHSA-8rm2-7qqf-34qm	github.com/prometheus/prometheus@v0.303.1	0.305.2
Medium	ALPINE-CVE-2026-28389	openssl@3.5.5-r0	3.5.6-r0
Medium	ALPINE-CVE-2026-28390	openssl@3.5.5-r0	3.5.6-r0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
12.11.13latest	6 months ago	0.44.0	119181771	11,689

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/mesosphere/prometheus-operator.svg)](https://charts.stackradar.io/charts/mesosphere/prometheus-operator)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.