truefoundry-monitoring Helm chart

Name: truefoundry-monitoring Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

truefoundry

Scored 14 Sept 2026

Monitoring stack for TrueFoundry control plane - Prometheus, Logs, and Grafana

Latest 0.1.6 4 months agoApp version not verified against the render 0Artifact Hub

truefoundry-monitoring 0.1.6 deploys 8 container images: public.ecr.aws/truefoundrycloud/timberio/vector, registry.k8s.io/kube-state-metrics/kube-state-metrics, quay.io/prometheus-operator/prometheus-operator, library/busybox and 4 more. Across the 7 measured, 444 findings — 0 critical, 3 high — 1 on CISA KEV. The highest contribution is ALPINE-CVE-2025-15467 in openssl 3.5.4-r0, fixed in 3.5.5-r0.

Radar Score

4,5260367374

444 findings over 7 of 8 images measured

KEV confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

8 images

Image	Tag	Vulnerabilities	Radar Score
public.ecr.aws/truefoundrycloud/timberio/vector	v0.52.0	001015	350
registry.k8s.io/kube-state-metrics/kube-state-metrics	v2.18.0	00665	618
quay.io/prometheus-operator/prometheus-operator	v0.88.0	00148	358
library/busybox	1.31.1	0000	0
quay.io/kiwigrid/k8s-sidecar×2	2.1.2	022257	1,062
grafana/grafana	12.3.0	0128146	1,846
tfy.jfrog.io/tfy-mirror/victoriametrics/victoria-logs	v1.48.0	—	unmeasured
ghcr.io/jkroepke/kube-webhook-certgen×2	1.7.4	00043	292

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

206 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	GHSA-78mq-xcr3-xm33	golang.org/x/crypto@v0.43.0	0.52.0
Low	GHSA-hrxh-6v49-42gf	google.golang.org/grpc@v1.76.0	1.82.1
Low	ALPINE-CVE-2026-34743	xz@5.8.1-r0	5.8.3-r0
Low	GHSA-ffqx-q65f-36jf	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	2.10.3
Low	GHSA-cp6g-7hqx-qxhp	go.mongodb.org/mongo-driver@v1.17.4	1.17.7
Low	GHSA-xmrv-pmrh-hhx2	github.com/aws/aws-sdk-go-v2/service/s3@v1.84.0	1.97.3
Low	GHSA-xmrv-pmrh-hhx2	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0	1.65.0
Low	GHSA-xmrv-pmrh-hhx2	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11	1.7.8
Low	GHSA-jq9f-gm9w-rwm9	github.com/openfga/openfga@v1.10.0	1.11.3
Low	GHSA-9m57-25v3-79x9	golang.org/x/crypto@v0.43.0	0.52.0
Low	GHSA-497x-rrr9-68jp	github.com/grafana/loki/v3@v3.2.1	3.6.4
Low	GHSA-65pc-fj4g-8rjx	idna@3.11	3.15
Low	GHSA-x86f-5xw2-fm2r	github.com/moby/moby@v27.5.1+incompatible	no fix listed
Low	ALPINE-CVE-2026-42769	openssl@3.5.4-r0	3.5.7-r0
Low	GHSA-vffh-x6r8-xx99	github.com/prometheus/prometheus@v0.303.1	0.311.2-0.20260410083055-07c6232d159b
Low	GHSA-2c64-vmv2-hgfc	github.com/openfga/openfga@v1.10.0	1.11.1
Low	GHSA-9h8m-3fm2-qjrq	go.opentelemetry.io/otel/sdk@v1.38.0	1.40.0
Low	ALPINE-CVE-2026-78408	util-linux@2.41-r9	2.41.6-r1
Low	GHSA-jpcw-4wr7-c3vq	github.com/getkin/kin-openapi@v0.133.0	0.144.0
Low	GHSA-cf98-j28v-49v6	github.com/openfga/openfga@v1.10.0	1.18.0
Low	GO-2026-4981	stdlib@go1.25.5	1.25.10
Low	GO-2026-4977	stdlib@go1.25.5	1.25.10
Low	GO-2026-4986	stdlib@go1.25.5	1.25.10
Low	GO-2026-4918	stdlib@go1.25.5	1.25.10
Low	GO-2026-4918	golang.org/x/net@v0.48.0	0.53.0
Low	GO-2026-4337	stdlib@go1.25.5	1.24.13
Low	GHSA-qccp-gfcp-xxvc	urllib3@2.5.0	2.7.0
Low	GHSA-h6c8-cww8-35hf	github.com/openfga/openfga@v1.10.0	1.13.1
Low	GO-2026-4601	stdlib@go1.25.5	1.25.8
Low	GHSA-fw8g-cg8f-9j28	github.com/prometheus/prometheus@v0.303.1	0.311.3
Low	GO-2026-5026	stdlib@go1.25.5	1.25.13
Low	GO-2026-5026	golang.org/x/net@v0.48.0	0.55.0
Low	ALPINE-CVE-2025-14104	util-linux@2.41-r9	2.41.6-r0
Low	GO-2026-4342	stdlib@go1.25.5	1.24.12
Low	GHSA-2v4p-qf9q-27wj	google.golang.org/grpc@v1.76.0	1.82.2
Low	ALPINE-CVE-2026-45446	openssl@3.5.4-r0	3.5.7-r0
Low	GO-2026-4870	stdlib@go1.25.5	1.25.9
Low	GO-2026-4947	stdlib@go1.25.5	1.25.9
Low	GHSA-rg2x-37c3-w2rh	github.com/moby/moby@v27.5.1+incompatible	no fix listed
Low	GO-2026-5037	stdlib@go1.25.5	1.25.11
Low	GO-2026-4971	stdlib@go1.25.5	1.25.10
Low	GO-2026-5972	stdlib@go1.25.5	1.25.13
Low	GO-2026-6088	stdlib@go1.25.5	1.25.13
Low	GO-2026-6089	stdlib@go1.25.5	1.25.13
Low	GO-2026-6090	stdlib@go1.25.5	1.25.13
Low	ALPINE-CVE-2026-27171	zlib@1.3.1-r2	1.3.2-r0
Low	GO-2026-5038	stdlib@go1.25.5	1.25.11
Low	GO-2026-5942	golang.org/x/net@v0.48.0	0.56.0
Low	GO-2026-6218	stdlib@go1.25.5	1.25.13
Low	GHSA-x746-7m8f-x49c	starlette@0.49.3	1.1.0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.1.6latest	4 months ago	—	0367374	4,526

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/truefoundry/truefoundry-monitoring.svg)](https://charts.stackradar.io/charts/truefoundry/truefoundry-monitoring)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.