kube-prometheus-stack87.21.0
Helm chartkube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
README badge
Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.
Radar Score
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 10
- On CISA KEV
- 0
- Exploited (EPSS ≥ 0.1)
- 0
10 findings over 1 of 6 images measured · scored 2 Sept 2026
Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.
History
Radar Score of 87.21.0, one sample per day, last 90 days. Hover a point for its date and advisory data.
Score moves
A score can move without the chart changing: the advisory data behind every finding is refreshed daily. Each move lists which inputs changed. Why a score moves
Fewer than two samples so far.
Findings
10 distinct across the version’s images
| Advisory | Package | Fixed in | Contribution | EPSS | Since | Digests |
|---|---|---|---|---|---|---|
| GO-2026-5026 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | stdlib@go1.26.5golang | 1.25.13 | 8/100 | 0.007 (50th pct) | 2 Sept 2026 | 8c9bac11973b |
| GO-2026-5972 Enforce maximum recursion depth in encoding/asn1 | stdlib@go1.26.5golang | 1.25.13 | 7/100 | 0.006 (45th pct) | 2 Sept 2026 | 8c9bac11973b |
| GO-2026-6088 Add recursion depth guard during decode in encoding/xml | stdlib@go1.26.5golang | 1.25.13 | 7/100 | 0.006 (45th pct) | 2 Sept 2026 | 8c9bac11973b |
| GO-2026-6089 Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http | stdlib@go1.26.5golang | 1.25.13 | 7/100 | 0.006 (45th pct) | 2 Sept 2026 | 8c9bac11973b |
| GO-2026-6090 Limit handshake messages we are willing to accept post-handshake in crypto/tls | stdlib@go1.26.5golang | 1.25.13 | 7/100 | 0.006 (45th pct) | 2 Sept 2026 | 8c9bac11973b |
| GO-2026-5942 Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage | stdlib@go1.26.5golang | 1.26.6 | 7/100 | 0.005 (44th pct) | 2 Sept 2026 | 8c9bac11973b |
| GO-2026-6218 Avoid quadratic complexity in resolvePath in net/url | stdlib@go1.26.5golang | 1.25.13 | 7/100 | 0.005 (42th pct) | 2 Sept 2026 | 8c9bac11973b |
| GO-2026-6303 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh | golang.org/x/crypto@v0.54.0golang | 0.55.0 | 6/100 | 0.003 (25th pct) | 2 Sept 2026 | 8c9bac11973b |
| GO-2026-6091 Fix Javascript regexp context tracking in html/template | stdlib@go1.26.5golang | 1.25.13 | 6/100 | 0.003 (23th pct) | 2 Sept 2026 | 8c9bac11973b |
| GO-2026-5932 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues | golang.org/x/crypto@v0.54.0golang | no fix listed | 4/100 | — | 2 Sept 2026 | 8c9bac11973b |
Workloads and images
Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.
| Container | Image | Tag | Digest | Radar Score |
|---|---|---|---|---|
| DaemonSet candidate-prometheus-node-exporter | ||||
| node-exporter | quay.io/prometheus/node-exporter | v1.12.1-distroless | 8c9bac11973b | 66 |
| Deployment candidate-grafana | ||||
| grafana-sc-dashboard | quay.io/kiwigrid/k8s-sidecar | 2.10.0 | 21b9fe7bb29d | not yet scanned |
| grafana-sc-datasources | quay.io/kiwigrid/k8s-sidecar | 2.10.0 | 21b9fe7bb29d | not yet scanned |
| grafana | grafana/grafana | 13.1.1 | 7cb8c64c4d57 | not yet scanned |
| Deployment candidate-kube-state-metrics | ||||
| kube-state-metrics | registry.k8s.io/kube-state-metrics/kube-state-metrics | v2.19.1 | 85108987d044 | not yet scanned |
| Deployment candidate-kube-prometheus-operator | ||||
| kube-prometheus-stack | quay.io/prometheus-operator/prometheus-operator | v0.92.1 | 7d9247d23514 | not yet scanned |
| Job candidate-kube-prometheus-admission-create | ||||
| createhook: pre-install,pre-upgrade | ghcr.io/jkroepke/kube-webhook-certgen | 1.8.5 | d0e80b2f62fe | not yet scanned |
| Job candidate-kube-prometheus-admission-patch | ||||
| patchhook: post-install,post-upgrade | ghcr.io/jkroepke/kube-webhook-certgen | 1.8.5 | d0e80b2f62fe | not yet scanned |
Unmeasured images (5)
quay.io/kiwigrid/k8s-sidecar:2.10.0not yet scanneddocker.io/grafana/grafana:13.1.1not yet scannedregistry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1not yet scannedquay.io/prometheus-operator/prometheus-operator:v0.92.1not yet scannedghcr.io/jkroepke/kube-webhook-certgen:1.8.5not yet scanned