opentelemetry-demo 0.42.1 Helm chart

Name: opentelemetry-demo Helm chart 0.42.1: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

opentelemetry-helm

Scored 26 Sept 2026

opentelemetry demo helm chart

Version 0.42.1 todayapp version 3.1.0 1Artifact Hub

opentelemetry-demo 0.42.1 deploys 34 container images: otel/opentelemetry-collector-contrib, quay.io/kiwigrid/k8s-sidecar, grafana/grafana, jaegertracing/jaeger and 7 more. Across the 33 measured, 2,058 findings — 3 critical, 2 high. The highest contribution is ALPINE-CVE-2025-15467 in openssl 3.5.4-r0, fixed in 3.5.5-r0.

Radar Score

21,387323581,692

2,058 findings over 33 of 34 images measured

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

34 images

Image	Tag	Vulnerabilities	Radar Score
otel/opentelemetry-collector-contrib	0.160.0	00610	172
quay.io/kiwigrid/k8s-sidecar×3	2.11.2	0005	42
grafana/grafana	13.2.2-distroless	00460	462
jaegertracing/jaeger	2.20.0	00926	343
quay.io/prometheus/prometheus	v3.14.0	00313	119
library/busybox×6	latest	0000	0
ghcr.io/open-telemetry/demo	3.1.0-accounting	00643	464
ghcr.io/open-telemetry/demo	3.1.0-ad	1030175	2,093
ghcr.io/open-telemetry/demo	3.1.0-agent	0010144	1,419
library/postgres	18.4	0025165	1,820
ghcr.io/open-telemetry/demo	3.1.0-cart	0000	0
ghcr.io/open-telemetry/demo	3.1.0-chatbot	0010143	1,412
ghcr.io/open-telemetry/demo	3.1.0-checkout	0001	4
ghcr.io/open-telemetry/demo	3.1.0-currency	0000	0
ghcr.io/open-telemetry/demo	3.1.0-email	001322	458
library/busybox	latest	0000	0
ghcr.io/open-feature/flagd	v0.16.0	00945	457
ghcr.io/open-telemetry/demo	3.1.0-flagd-ui	001079	889
ghcr.io/open-telemetry/demo	3.1.0-fraud-detection	0024104	1,329
ghcr.io/open-telemetry/demo	3.1.0-frontend	00715	274
ghcr.io/open-telemetry/demo	3.1.0-frontend-proxy	123689	1,655
ghcr.io/open-telemetry/demo	3.1.0-image-provider	102662	1,080
ghcr.io/open-telemetry/demo	3.1.0-kafka	001441	623
ghcr.io/open-telemetry/demo	3.1.0-load-generator	0044203	2,583
ghcr.io/open-telemetry/demo	3.1.0-mcp	0010144	1,419
ghcr.io/open-telemetry/demo	3.1.0-opamp-server	0078	203
ghcr.io/open-telemetry/demo	3.1.0-payment	002031	709
ghcr.io/open-telemetry/demo	3.1.0-product-catalog	0000	0
ghcr.io/open-telemetry/demo	3.1.0-quote	0045	132
ghcr.io/open-telemetry/demo	3.1.0-recommendation	0004	37
ghcr.io/open-telemetry/demo	3.1.0-shipping	00715	274
ghcr.io/open-telemetry/demo	3.1.0-telemetry-docs	001834	732
ghcr.io/valkey-io/valkey	9.0.4-alpine3.23	0066	183
opensearchproject/opensearch×2	3.8.0	—	not yet scanned

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

774 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	ALPINE-CVE-2026-42768	openssl@3.5.6-r0	3.5.7-r0
Low	GO-2022-0635	github.com/aws/aws-sdk-go@v1.55.8	no fix listed
Low	DEBIAN-CVE-2026-41991	gzip@1.13-1	1.13-1+deb13u1
Low	UBUNTU-CVE-2025-9820	gnutls28@3.7.3-4ubuntu1.9	no fix listed
Low	DEBIAN-CVE-2026-22185	openldap@2.6.10+dfsg-1	no fix listed
Low	GO-2026-5027	golang.org/x/net@v0.51.0	0.55.0
Low	GO-2026-5029	golang.org/x/net@v0.51.0	0.55.0
Low	GO-2026-5030	golang.org/x/net@v0.51.0	0.55.0
Low	ALPINE-CVE-2026-34757	libpng@1.6.54-r0	1.6.57-r0
Low	DEBIAN-CVE-2026-22018	openjdk-17@17.0.18+8-1~deb12u1	17.0.19+10-1~deb12u2
Low	DEBIAN-CVE-2026-60589	openjdk-17@17.0.18+8-1~deb12u1	17.0.20.1+1-1~deb12u1
Low	ALPINE-CVE-2026-42770	openssl@3.5.6-r0	3.5.7-r0
Low	UBUNTU-CVE-2026-42770	openssl@3.0.2-0ubuntu1.29	no fix listed
Low	DEBIAN-CVE-2026-96674	alsa-lib@1.2.8-1+b1	no fix listed
Low	DEBIAN-CVE-2026-47010	openjdk-17@17.0.18+8-1~deb12u1	17.0.20+8-1~deb12u1
Low	DEBIAN-CVE-2026-96675	alsa-lib@1.2.8-1+b1	no fix listed
Low	ALPINE-CVE-2026-27456	util-linux@2.41-r9	2.41.6-r0
Low	UBUNTU-CVE-2026-27456	util-linux@2.37.2-4ubuntu3.5	2.37.2-4ubuntu3.6
Low	DEBIAN-CVE-2026-39113	sqlite3@3.46.1-7+deb13u1	no fix listed
Low	DEBIAN-CVE-2026-18508	tar@1.35+dfsg-3.1	no fix listed
Low	DEBIAN-CVE-2025-68972	gnupg2@2.2.40-1.1+deb12u2	no fix listed
Low	GO-2026-4869	stdlib@go1.25.7	1.25.9
Low	GO-2026-4970	stdlib@go1.26.4	1.25.12
Low	UBUNTU-CVE-2026-41990	libgcrypt20@1.10.3-2ubuntu0.2	1.12.0-2ubuntu0.1~Fips1~rc11
Low	GO-2026-4864	stdlib@go1.25.7	1.25.9
Low	UBUNTU-CVE-2022-3219	gnupg2@2.4.4-2ubuntu17.6	no fix listed
Low	ALPINE-CVE-2026-41080	expat@2.7.5-r0	2.8.1-r0
Low	UBUNTU-CVE-2026-41080	expat@2.6.1-2ubuntu0.3	2.6.1-2ubuntu0.5
Low	GO-2026-5024	golang.org/x/sys@v0.39.0	0.44.0
Low	DEBIAN-CVE-2026-87876	cups@2.4.2-3+deb12u9	no fix listed
Low	GO-2026-6179	golang.org/x/mod@v0.33.0	0.40.0
Low	DEBIAN-CVE-2025-1181	binutils@2.44-3	no fix listed
Low	GHSA-q2mw-fvj9-vvcw	net-imap@0.6.2	0.6.4
Low	DEBIAN-CVE-2025-1180	binutils@2.44-3	no fix listed
Low	DEBIAN-CVE-2025-11731	libxslt@1.1.35-1.2+deb13u3	no fix listed
Low	ALPINE-CVE-2025-69418	openssl@3.5.4-r0	3.5.5-r0
Low	UBUNTU-CVE-2025-69418	openssl@3.0.2-0ubuntu1.29	no fix listed
Low	DEBIAN-CVE-2007-5686	shadow@1:4.17.4-2	no fix listed
Low	DEBIAN-CVE-2025-1151	binutils@2.44-3	no fix listed
Low	GO-2026-4602	stdlib@go1.25.7	1.25.8
Low	DEBIAN-CVE-2025-1182	binutils@2.44-3	no fix listed
Low	DEBIAN-CVE-2026-18477	tar@1.35+dfsg-3.1	no fix listed
Low	ALPINE-CVE-2025-46394	busybox@1.37.0-r19	1.37.0-r20
Low	DEBIAN-CVE-2026-94282	libxi@2:1.8-1+b1	no fix listed
Low	GO-2026-5841	github.com/klauspost/compress@v1.18.2	1.18.7
Low	GO-2026-5932	golang.org/x/crypto@v0.56.0	no fix listed
Low	GO-2026-6061	google.golang.org/grpc@v1.81.1	1.82.1
Low	USN-8091-1	util-linux@2.39.3-9ubuntu6.3	2.39.3-9ubuntu6.5
Low	USN-8436-1	ca-certificates@20240203	20260601~24.04.1
Low	USN-8543-2	wget@1.21.4-1ubuntu4.1	1.21.4-1ubuntu4.5

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.42.1latest	today	3.1.0	323581,692	21,387
0.42.0	7 days ago	3.1.0	323581,692	21,387
0.41.2	10 days ago	3.0.0	053751,905	23,639
0.41.1	15 days ago	3.0.0	053751,905	23,639
0.41.0	1 month ago	3.0.0	053751,905	23,639

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/opentelemetry-helm/opentelemetry-demo.svg)](https://charts.stackradar.io/charts/opentelemetry-helm/opentelemetry-demo)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.