flux2 Helm chart

Name: flux2 Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

fluxcd-community

Scored 21 Oct 2026

A Helm chart for flux2

Latest 2.19.1 1 month agodeploys tag v1.6.4 27Artifact Hub

flux2 2.19.1 deploys 7 container images: ghcr.io/fluxcd/helm-controller, ghcr.io/fluxcd/image-automation-controller, ghcr.io/fluxcd/image-reflector-controller, ghcr.io/fluxcd/kustomize-controller and 3 more. Across them, 383 findings — 0 critical, 0 high. The highest contribution is ALPINE-CVE-2026-63073 in openssl 3.5.7-r0, fixed in 3.5.8-r0.

Radar Score

4,7390085298

383 findings over 7 of 7 images measured

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

7 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/fluxcd/helm-controller	v1.6.4	001131	532
ghcr.io/fluxcd/image-automation-controller	v1.2.5	001032	529
ghcr.io/fluxcd/image-reflector-controller	v1.2.5	001031	519
ghcr.io/fluxcd/kustomize-controller	v1.9.5	002063	1,054
ghcr.io/fluxcd/notification-controller	v1.9.4	001038	566
ghcr.io/fluxcd/source-controller	v1.9.5	001139	600
ghcr.io/fluxcd/flux-cli	v2.9.5	001364	939

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

131 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	GO-2026-4982	stdlib@go1.26.2	1.25.10
Low	GO-2026-5025	golang.org/x/net@v0.49.0	0.55.0
Low	ALPINE-CVE-2026-89160	pcre2@10.47-r0	10.48-r0
Low	ALPINE-CVE-2026-102633	expat@2.8.3-r0	2.9.0-r0
Low	GO-2026-6091	stdlib@go1.26.2	1.25.13
Low	GHSA-hrxh-6v49-42gf	google.golang.org/grpc@v1.81.1	1.82.1
Low	ALPINE-CVE-2026-89158	pcre2@10.47-r0	10.48-r0
Low	GO-2026-4976	stdlib@go1.26.2	1.25.10
Low	GO-2026-5039	stdlib@go1.26.2	1.25.11
Low	ALPINE-CVE-2026-89156	pcre2@10.47-r0	10.48-r0
Low	ALPINE-CVE-2026-89161	pcre2@10.47-r0	10.48-r0
Low	GO-2026-5856	stdlib@go1.26.2	1.25.12
Low	ALPINE-CVE-2026-76957	expat@2.8.3-r0	2.8.4-r0
Low	GO-2026-5027	golang.org/x/net@v0.49.0	0.55.0
Low	GO-2026-5029	golang.org/x/net@v0.49.0	0.55.0
Low	GO-2026-5030	golang.org/x/net@v0.49.0	0.55.0
Low	GO-2026-5158	go.opentelemetry.io/otel@v1.43.0	1.42.0
Low	GO-2026-6599	stdlib@go1.26.7	1.26.9
Low	GO-2026-6600	stdlib@go1.26.7	1.26.9
Low	GHSA-h7vf-4x9w-h99v	oras.land/oras-go/v2@v2.6.1	2.6.2
Low	GHSA-gcjh-h69q-9w9g	github.com/google/cel-go@v0.27.0	0.29.0
Low	GO-2025-3547	k8s.io/kubernetes@v1.36.1	no fix listed
Low	GO-2026-5932	golang.org/x/crypto@v0.53.0	no fix listed
Low	GO-2026-6225	github.com/chrismellard/docker-credential-acr-env@v0.0.0-20230304212654-82a0ddb27589	no fix listed
Low	GO-2026-6809	stdlib@go1.26.7	1.26.10
Low	GO-2026-5024	golang.org/x/sys@v0.40.0	0.44.0
Low	ALPINE-CVE-2026-89162	pcre2@10.47-r0	10.48-r0
Low	GHSA-wqqc-jjcq-vfxm	github.com/sigstore/sigstore-go@v1.2.0	1.2.1
Low	GHSA-8wmf-6v46-5gfg	go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0	1.45.0
Low	GHSA-8wmf-6v46-5gfg	go.opentelemetry.io/otel/sdk@v1.44.0	1.45.0
Low	GHSA-8wmf-6v46-5gfg	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.44.0	1.45.0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
2.19.1latest	1 month ago	v1.6.4	0085298	4,739
2.19.0	3 months ago	v1.6.2	0064310	4,214

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/fluxcd-community/flux2.svg)](https://charts.stackradar.io/charts/fluxcd-community/flux2)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.