flux2 Helm chart

Name: flux2 Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

fluxcd-community

Scored 21 Oct 2026

A Helm chart for flux2

Latest 2.19.1 1 month agodeploys tag v1.6.4 27Artifact Hub

flux2 2.19.1 deploys 7 container images: ghcr.io/fluxcd/helm-controller, ghcr.io/fluxcd/image-automation-controller, ghcr.io/fluxcd/image-reflector-controller, ghcr.io/fluxcd/kustomize-controller and 3 more. Across them, 383 findings — 0 critical, 0 high. The highest contribution is ALPINE-CVE-2026-63073 in openssl 3.5.7-r0, fixed in 3.5.8-r0.

Radar Score

4,7390085298

383 findings over 7 of 7 images measured

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

7 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/fluxcd/helm-controller	v1.6.4	001131	532
ghcr.io/fluxcd/image-automation-controller	v1.2.5	001032	529
ghcr.io/fluxcd/image-reflector-controller	v1.2.5	001031	519
ghcr.io/fluxcd/kustomize-controller	v1.9.5	002063	1,054
ghcr.io/fluxcd/notification-controller	v1.9.4	001038	566
ghcr.io/fluxcd/source-controller	v1.9.5	001139	600
ghcr.io/fluxcd/flux-cli	v2.9.5	001364	939

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

131 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	ALPINE-CVE-2026-76641	expat@2.8.3-r0	2.8.4-r0
Low	GO-2026-6218	stdlib@go1.26.2	1.25.13
Low	GO-2026-5942	stdlib@go1.26.2	1.26.6
Low	GO-2026-5942	golang.org/x/net@v0.49.0	0.56.0
Low	GHSA-pjcq-xvwq-hhpj	github.com/Azure/go-ntlmssp@v0.0.0-20221128193559-754e69321358	0.1.1
Low	ALPINE-CVE-2026-86145	pcre2@10.47-r0	10.48-r0
Low	GO-2026-6355	golang.org/x/crypto@v0.53.0	0.56.0
Low	ALPINE-CVE-2026-82209	curl@8.20.0-r0	8.22.0-r0
Low	ALPINE-CVE-2026-85091	zlib@1.3.2-r0	1.3.2-r1
Low	ALPINE-CVE-2026-80255	curl@8.20.0-r0	8.22.0-r0
Low	GO-2026-5970	golang.org/x/text@v0.33.0	0.39.0
Low	ALPINE-CVE-2026-13608	curl@8.20.0-r0	8.22.0-r0
Low	GO-2025-3521	k8s.io/kubernetes@v1.36.1	no fix listed
Low	ALPINE-CVE-2026-9080	curl@8.20.0-r0	8.22.0-r0
Low	GHSA-f5mr-q85p-6hh6	github.com/sigstore/fulcio@v1.8.5	1.8.6
Low	GO-2026-6303	golang.org/x/crypto@v0.53.0	0.55.0
Low	GO-2026-6354	golang.org/x/crypto@v0.53.0	0.56.0
Low	GO-2026-6617	stdlib@go1.26.7	1.26.9
Low	GO-2026-6617	golang.org/x/net@v0.56.0	0.60.0
Low	ALPINE-CVE-2026-75803	openssl@3.5.7-r0	3.5.8-r0
Low	ALPINE-CVE-2026-9545	curl@8.20.0-r0	8.22.0-r0
Low	ALPINE-CVE-2026-82208	curl@8.20.0-r0	8.22.0-r0
Low	GO-2026-6608	stdlib@go1.26.7	1.26.9
Low	ALPINE-CVE-2026-12064	curl@8.20.0-r0	8.22.0-r0
Low	ALPINE-CVE-2026-8932	curl@8.20.0-r0	8.22.0-r0
Low	GO-2026-6607	stdlib@go1.26.7	1.26.9
Low	ALPINE-CVE-2026-8286	curl@8.20.0-r0	8.22.0-r0
Low	GO-2026-6609	stdlib@go1.26.7	1.26.9
Low	ALPINE-CVE-2026-80230	curl@8.20.0-r0	8.22.0-r0
Low	GHSA-259r-337f-4rfw	github.com/klauspost/compress@v1.18.5	1.18.7
Low	GO-2026-6629	golang.org/x/text@v0.39.0	0.41.0
Low	GO-2026-6613	stdlib@go1.26.7	1.26.9
Low	ALPINE-CVE-2026-9547	curl@8.20.0-r0	8.22.0-r0
Low	GO-2026-6605	stdlib@go1.26.7	1.26.9
Low	GO-2026-6610	stdlib@go1.26.7	1.26.9
Low	GO-2026-6610	golang.org/x/net@v0.56.0	0.60.0
Low	GHSA-hc8v-wwc9-vgxm	github.com/go-git/go-git/v5@v5.19.1	5.19.2
Low	GHSA-5cv4-jp36-h3mw	golang.org/x/net@v0.49.0	0.55.0
Low	GO-2026-6180	golang.org/x/mod@v0.37.0	0.40.0
Low	GHSA-fxhp-mv3v-67qp	oras.land/oras-go/v2@v2.6.1	2.6.2
Low	ALPINE-CVE-2026-76956	expat@2.8.3-r0	2.8.4-r0
Low	ALPINE-CVE-2026-63074	openssl@3.5.7-r0	3.5.8-r0
Low	ALPINE-CVE-2026-89157	pcre2@10.47-r0	10.48-r0
Low	GO-2026-4970	stdlib@go1.26.2	1.25.12
Low	GHSA-qgq7-7hm3-q39j	github.com/go-git/go-git/v5@v5.19.1	5.19.2
Low	ALPINE-CVE-2026-8458	curl@8.20.0-r0	8.22.0-r0
Low	ALPINE-CVE-2026-103111	pcre2@10.47-r0	10.49-r0
Low	GO-2026-4980	stdlib@go1.26.2	1.25.10
Low	GHSA-qc2q-p7wx-3px3	google.golang.org/grpc@v1.81.1	1.83.1
Low	GO-2026-6179	golang.org/x/mod@v0.37.0	0.40.0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
2.19.1latest	1 month ago	v1.6.4	0085298	4,739
2.19.0	3 months ago	v1.6.2	0064310	4,214

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/fluxcd-community/flux2.svg)](https://charts.stackradar.io/charts/fluxcd-community/flux2)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.