clowder2 Helm chart

Name: clowder2 Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

ncsa

Scored 14 Sept 2026

Open Source Data Management for Long Tail Data. Clowder is a customizable and scalable data management framework to support any data format and multiple research domains.

Latest 1.9.7 9 months agoapp version 2.0.0-beta.4 1Artifact Hub

clowder2 1.9.7 deploys 12 container images: bitnamilegacy/minio, bitnamilegacy/mongodb, clowder/clowder2-backend, clowder/clowder2-frontend and 8 more. Across them, 3,298 findings — 14 critical, 33 high — 12 on CISA KEV. The highest contribution is GHSA-f58c-gq56-vjjf in tika-core 2.7.0, fixed in 3.2.2.

Radar Score

37,37314334692,779

3,298 findings over 12 of 12 images measured

KEV ×12 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

12 images

Image	Tag	Vulnerabilities	Radar Score
bitnamilegacy/minio	2023.12.23	0226180	2,291
bitnamilegacy/mongodb	5.0.10	1631206	2,886
clowder/clowder2-backend	2.0.0-beta.4	0246243	3,250
clowder/clowder2-frontend	2.0.0-beta.4	012074	1,091
clowder/clowder2-heartbeat	2.0.0-beta.4	0246243	3,250
clowder/clowder2-messages	2.0.0-beta.4	0246243	3,250
bitnamilegacy/os-shell×4	12-debian-12-r16	3662308	4,456
bitnamilegacy/elasticsearch×8	8.12.2	7695538	7,598
bitnamilegacy/postgresql	15.5.0	2025125	1,897
library/busybox	1.28	0000	0
bitnamilegacy/keycloak	20.0.5	1357454	5,465
bitnamilegacy/rabbitmq	3.10.8	0315165	1,939

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

1,214 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	BIT-java-2025-30698	Java@17.0.10-13-2	1.8.0
Low	BIT-java-2025-30698	java@17.0.6-10-4	1.8.0
Low	ALPINE-CVE-2026-76642	util-linux@2.41-r9	2.41.6-r0
Low	DEBIAN-CVE-2026-76642	util-linux@2.38.1-5+deb12u3	no fix listed
Low	BIT-java-2026-47063	Java@17.0.10-13-2	1.8.0
Low	BIT-java-2026-47063	java@17.0.6-10-4	1.8.0
Low	GHSA-9vm7-v8wj-3fqw	keycloak-core@20.0.5	23.0.4
Low	DSA-5587-1	curl@7.74.0-1.3+deb11u7	7.74.0-1.3+deb11u11
Low	DEBIAN-CVE-2024-28834	gnutls28@3.7.9-2+deb12u2	3.7.9-2+deb12u3
Low	GHSA-mfx4-hv73-q22v	aiohttp@3.11.10	3.14.2
Low	DEBIAN-CVE-2026-11822	sqlite3@3.40.1-2+deb12u2	no fix listed
Low	DEBIAN-CVE-2026-11824	sqlite3@3.40.1-2+deb12u2	no fix listed
Low	GO-2023-1568	stdlib@go1.18.2	1.19.6
Low	GHSA-cq5v-8q36-5273	aiohttp@3.11.10	3.14.3
Low	GHSA-mv64-86g8-cqq7	resteasy-reactive@2.13.7.Final	3.2.11.Final
Low	BIT-postgresql-2026-6471	PostgreSQL@15.5.0-42	14.24.0
Low	BIT-postgresql-2026-6471	postgresql@15.5.0-42	14.24.0
Low	GO-2022-1037	stdlib@go1.18.2	1.18.7
Low	BIT-gdal-2026-8087	GDAL@3.8.3	3.13.0
Low	GHSA-6cqp-g7gg-8hr5	netty-codec-http@4.1.86.Final	4.1.136.Final
Low	BIT-java-2024-21140	Java@17.0.10-13-2	1.8.0
Low	BIT-java-2024-21140	java@17.0.6-10-4	1.8.0
Low	GHSA-v5gw-mw7f-84px	starlette@0.26.1	0.27.0
Low	DEBIAN-CVE-2025-40909	perl@5.36.0-7+deb12u1	5.36.0-7+deb12u3
Low	GHSA-2vrm-gr82-f7m5	aiohttp@3.11.10	3.13.4
Low	BIT-java-2024-21235	Java@17.0.10-13-2	1.8.0
Low	BIT-java-2024-21235	java@17.0.6-10-4	1.8.0
Low	GHSA-6hg6-v5c8-fphq	log4j-core@2.12.4	2.25.4
Low	BIT-java-2025-53057	Java@17.0.10-13-2	1.8.0
Low	BIT-java-2025-53057	java@17.0.6-10-4	1.8.0
Low	DEBIAN-CVE-2026-48961	perl@5.36.0-7+deb12u3	no fix listed
Low	GHSA-72hv-8253-57qq	jackson-core@2.15.0	2.18.6
Low	GHSA-53jx-vvf9-4x38	vertx-web@4.3.4	4.3.8
Low	GO-2023-1987	stdlib@go1.18.2	1.19.12
Low	BIT-mongodb-2024-7553	mongodb@5.0.10-0	5.0.27
Low	BIT-elasticsearch-2026-72683	elasticsearch@8.12.2-0	8.19.19
Low	BIT-elasticsearch-2026-72683	Elasticsearch@8.12.2-0	8.19.19
Low	BIT-elasticsearch-2026-72686	elasticsearch@8.12.2-0	8.19.20
Low	BIT-elasticsearch-2026-72686	Elasticsearch@8.12.2-0	8.19.20
Low	GHSA-rr5q-3xwr-f323	keycloak-server-spi-private@20.0.5	26.6.3
Low	GHSA-rr5q-3xwr-f323	keycloak-services@20.0.5	26.6.3
Low	GHSA-4x37-hw65-52w8	keycloak-services@20.0.5	26.6.2
Low	BIT-keycloak-2026-18214	keycloak@20.0.5-6	26.7.3
Low	ALPINE-CVE-2026-63074	openssl@3.5.4-r0	3.5.8-r0
Low	DEBIAN-CVE-2026-63074	openssl@3.0.17-1~deb12u3	no fix listed
Low	GHSA-m4cv-j2px-7723	netty-codec-http@4.1.86.Final	4.1.133.Final
Low	BIT-keycloak-2026-18215	keycloak@20.0.5-6	26.7.3
Low	GO-2023-1752	stdlib@go1.18.2	1.19.9
Low	GHSA-mq44-7p77-q5h7	aiohttp@3.11.10	3.14.2
Low	DLA-3926-1	perl@5.32.1-4+deb11u2	5.32.1-4+deb11u4

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
1.9.7latest	9 months ago	2.0.0-beta.4	14334692,779	37,373

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/ncsa/clowder2.svg)](https://charts.stackradar.io/charts/ncsa/clowder2)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.