The official Helm chart to deploy Apache Airflow, a platform to programmatically author, schedule, and monitor workflows
airflow
v1.22.04 High
3 Medium
3 Low
9 accounts
10 workloads
10 bindings
Image risk: Exploited · 4 KEV · 26 critical CVEs
Open source Kubernetes security intelligence
Know what your RBAC policies can do.
Explore the identities and permissions behind popular Kubernetes projects. RBAC Atlas turns complex access rules into clear findings, risks, and paths to investigate.
START EXPLORING
Follow the signal
Find patterns across the ecosystem, then inspect a project in detail.
01 / EXPLORE
Popular risks
See the permissions and behaviors that appear most often.
02 / DISCOVER
Project categories
Browse policies by the tools and workloads they protect.
THE BIGGER PICTURE
Threat landscape
A running view of RBAC risk across the open source Kubernetes ecosystem.
RISK INTELLIGENCE
Risk distribution over time
Critical
893
High
1044
Medium
532
Low
5704
Image CVEs × RBAC
Riskiest combinations
159 workloads pair Critical/High RBAC with an image carrying known-exploited (KEV) or likely-exploitable CVEs · 55 with CISA KEV CVEs · 56 charts
- grafana/loki-simple-scalable 1.8.11Deployment/loki-simple-scalable-grafana-agent-operator container grafana-agent-operatorKEVCVE-2023-4911LikelyCVE-2019-8457CVE-2022-37434+3
- KEVCVE-2023-44487LikelyCVE-2024-41110CVE-2023-38545+3
- KEVCVE-2021-39226LikelyCVE-2021-3711CVE-2022-37434+3
- KEVCVE-2021-39226LikelyCVE-2021-3711CVE-2022-37434+3
- prometheus-community/prometheus-operator 9.3.2Deployment/prometheus-operator-grafana container grafanaKEVCVE-2021-39226LikelyCVE-2021-3711CVE-2022-37434+3
CVE data covers 582 of 633 images; 88.1% of CVE IDs enriched by cve.now. Latest stable chart versions, default images only; a CVE in an image is not proof it is exploitable. Full ranking and methodology
EXPLORE THE INDEX
All projects
airflow-operator
v0.4.0-dev4 Critical
1 High
1 Medium
4 Low
1 accounts
1 workloads
10 bindings
The Kubedoop operator for Apache airflow
ais-operator
v4.3.07 Critical
5 High
4 Medium
20 Low
1 accounts
1 workloads
36 bindings
Image risk: Low
Helm Chart for AIStore K8s Operator
8 Critical
8 High
4 Medium
13 Low
1 accounts
1 workloads
33 bindings
Image risk: Elevated · 1 critical CVEs
Helm chart for MinIO AIStor Key Manager operator
16 Critical
16 High
8 Medium
26 Low
2 accounts
2 workloads
66 bindings
Image risk: Elevated · 1 critical CVEs
Helm chart for MinIO AIStor Object Store operator
aistor-operator
v6.2.17 Critical
3 High
6 Medium
42 Low
3 accounts
3 workloads
58 bindings
Image risk: Moderate
Helm chart for MinIO AIStor operators
aistor-volumemanager
v0.3.33 Critical
2 Medium
14 Low
1 accounts
1 workloads
19 bindings
Image risk: Exploited · 2 KEV · 3 critical CVEs
DirectPV - AIStor Volume Manager
alertmanager
v2.3.11 accounts
1 workloads
0 bindings
Image risk: Moderate
The Alertmanager handles alerts sent by client applications such as the Prometheus server.
5 Critical
1 Medium
23 Low
2 accounts
1 workloads
29 bindings
Helm chart to deploy altinity-clickhouse-operator . The ClickHouse Operator creates, configures and manages ClickHouse clusters running on Kubernetes.
apm-server
v8.5.12 Low
1 accounts
1 workloads
2 bindings
Image risk: High · 5 critical CVEs
Official Elastic helm chart for Elastic APM Server
appmesh-prometheus
v1.0.31 Critical
5 Low
1 accounts
1 workloads
6 bindings
Image risk: Exploited · 1 KEV · 6 critical CVEs
App Mesh Prometheus Helm chart for Kubernetes
appmesh-spire-agent
v1.0.71 Critical
2 Low
1 accounts
1 workloads
3 bindings
SPIRE Agent Helm chart for AppMesh mTLS support on Kubernetes
argo-cd
v10.14.08 Critical
5 High
3 Medium
35 Low
9 accounts
11 workloads
51 bindings
Image risk: Elevated · 1 critical CVEs
A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.
argo-events
v2.4.278 Critical
11 Low
2 accounts
1 workloads
19 bindings
Image risk: Elevated · 7 critical CVEs
A Helm chart for Argo Events, the event-driven workflow automation framework
argo-rollouts
v2.43.92 Critical
2 High
43 Low
1 accounts
1 workloads
47 bindings
Image risk: Moderate
A Helm chart for Argo Rollouts
argocd-image-updater
v1.4.22 Critical
1 High
1 Medium
6 Low
1 accounts
1 workloads
10 bindings
Image risk: Exploited · 1 KEV · 1 critical CVEs
A Helm chart for Argo CD Image Updater, a tool to automatically update the container images of Kubernetes workloads which are managed by Argo CD
authentik
v2023.10.712 Low
2 accounts
2 workloads
12 bindings
Image risk: Exploited* · 1 KEV · 21 critical CVEs
authentik is an open-source Identity Provider focused on flexibility and versatility
authorino-operator
v0.27.06 Critical
4 High
3 Medium
9 Low
1 accounts
1 workloads
22 bindings
Image risk: Elevated · 1 critical CVEs
Kubernetes operator for managing Authorino instances, a K8s-native AuthN/AuthZ service to protect your APIs.
aws-cloudwatch-metrics
v0.0.111 Critical
12 Low
1 accounts
1 workloads
13 bindings
Image risk: High · 4 critical CVEs
A Helm chart to deploy aws-cloudwatch-metrics project
aws-for-fluent-bit
v0.2.01 Critical
5 Low
1 accounts
1 workloads
6 bindings
Image risk: Exploited · 1 KEV
A Helm chart to deploy aws-for-fluent-bit project
base
v1.31.0-alpha.01 accounts
0 workloads
0 bindings
Helm chart for deploying Istio cluster resources and CRDs
bitpoke
v1.8.192 accounts
3 workloads
0 bindings
Image risk: High · 4 critical CVEs
The Bitpoke App for WordPress provides a versatile dashboard to create, deploy, scale, manage and monitor WordPress sites in a Kubernetes cluster.
bitwarden-crd-operator
v0.19.01 Critical
10 Low
1 accounts
1 workloads
11 bindings
Image risk: Exploited · 1 KEV · 3 critical CVEs
Deploy the Bitwarden CRD Operator
capa-vpc-peering-operator
v2023.12.112 High
2 Low
1 accounts
1 workloads
4 bindings
Image risk: High · 2 critical CVEs
A Helm chart for CAPA VPC Peering Operator by AppsCode
capsule
v0.15.25 Critical
3 High
2 Medium
26 Low
6 accounts
6 workloads
36 bindings
Image risk: Exploited · 1 KEV · 10 critical CVEs
A Helm chart to deploy the Capsule Operator for easily implementing, managing, and maintaining multitenancy and access control in Kubernetes.
capsule-proxy
v0.15.35 Critical
3 High
2 Medium
6 Low
2 accounts
2 workloads
16 bindings
Image risk: Exploited · 1 KEV · 10 critical CVEs
Helm Chart for Capsule Proxy, addon for Capsule, the multi-tenant Operator
cd-pipeline-operator
v2.33.11 Critical
1 High
16 Low
1 accounts
1 workloads
18 bindings
Image risk: Moderate
A Helm chart for KubeRocketCI CD Pipeline Operator
cd-pipeline-operator
v2.34.0-SNAPSHOT.51 Critical
1 High
16 Low
1 accounts
1 workloads
18 bindings
Image risk: Moderate
A Helm chart for KubeRocketCI CD Pipeline Operator
cert-manager
v1.21.37 Critical
3 Medium
60 Low
4 accounts
4 workloads
70 bindings
Image risk: Moderate
A Helm chart for cert-manager
cilium
v1.21.0-pre.03 Critical
1 Medium
87 Low
3 accounts
3 workloads
91 bindings
eBPF-based Networking, Security, and Observability
cloudflare-operator
v1.10.81 Critical
14 Low
1 accounts
1 workloads
15 bindings
Image risk: Moderate
Helm chart for Cloudflare Operator
cloudnative-pg
v0.29.16 Critical
3 Medium
37 Low
1 accounts
1 workloads
46 bindings
Image risk: Moderate
CloudNativePG Operator Helm Chart
codebase-operator
v2.36.01 Critical
32 Low
1 accounts
1 workloads
33 bindings
Image risk: Moderate
A Helm chart for KubeRocketCI Codebase Operator
codebase-operator
v2.37.0-SNAPSHOT.61 Critical
32 Low
1 accounts
1 workloads
33 bindings
Image risk: Moderate
A Helm chart for KubeRocketCI Codebase Operator
commons-operator
v0.4.02 Critical
1 High
3 Low
1 accounts
1 workloads
6 bindings
Image risk: Elevated · 1 critical CVEs
Commons operator of Kubedoop
3 Low
1 accounts
1 workloads
3 bindings
Master chart to deploy and configure the Compliance Operator
confluence
v2.0.211 accounts
2 workloads
0 bindings
Image risk: High · 7 critical CVEs
A chart for installing Confluence Data Center on Kubernetes
consul
v2.1.0-rc13 Critical
2 High
4 Medium
100 Low
7 accounts
7 workloads
109 bindings
Official HashiCorp Consul Chart
coredns
v1.50.25 Low
1 accounts
1 workloads
5 bindings
Image risk: Moderate
CoreDNS is a DNS server that chains plugins and provides Kubernetes DNS Services
cost-analyzer
v2.9.73 Critical
3 High
7 Medium
43 Low
4 accounts
5 workloads
56 bindings
Image risk: Exploited · 2 KEV · 10 critical CVEs
Kubecost Helm chart - monitor your cloud costs!
crossplane
v2.4.34 Critical
1 Medium
11 Low
2 accounts
2 workloads
16 bindings
Image risk: Moderate
Crossplane is an open source Kubernetes add-on that enables platform teams to assemble infrastructure from multiple vendors, and expose higher level self-service APIs for application teams to consume.
dash0-operator
v0.159.011 Critical
6 High
6 Medium
83 Low
1 accounts
1 workloads
106 bindings
Image risk: Moderate
The Dash0 Operator makes observability easy for every Kubernetes setup, simply install the operator into your cluster to get OpenTelemetry data flowing from your applications and infrastructure to Dash0.
datadog
v3.269.119 Critical
31 High
17 Medium
299 Low
4 accounts
4 workloads
366 bindings
Image risk: Exploited · 1 KEV · 6 critical CVEs
Datadog Agent
datadog-operator
v2.32.0-dev.515 Critical
23 High
6 Medium
126 Low
1 accounts
1 workloads
170 bindings
Image risk: Moderate
Datadog Operator
deployment
v1.0.470 accounts
1 workloads
0 bindings
The Universal Deployment Helm Chart
directpv
v0.4.53 Critical
2 Medium
14 Low
1 accounts
1 workloads
19 bindings
Image risk: Exploited · 1 KEV · 1 critical CVEs
DirectPV
dns-operator
v0.18.02 Critical
1 High
10 Low
2 accounts
1 workloads
13 bindings
Image risk: Moderate
Kubernetes operator responsible for reconciling DNS Record custom resources.
docker-machine-operator
v2024.7.91 Critical
1 High
1 accounts
1 workloads
2 bindings
Image risk: High · 4 critical CVEs
A Helm chart for Docker Machine Operator by AppsCode
6 Critical
3 High
1 Medium
6 Low
1 accounts
1 workloads
16 bindings
Image risk: Elevated · 1 critical CVEs
The Kubedoop operator for Apache DolphinScheduler
doris-operator
v25.8.05 Critical
4 High
2 Medium
12 Low
1 accounts
1 workloads
23 bindings
Image risk: Elevated · 1 critical CVEs
Doris Operator for creating, configuring and managing Doris clusters (dcr) and Doris disaggregated clusters (ddc).