clowder2 Helm chart

Name: clowder2 Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

ncsa

Scored 15 Sept 2026

Open Source Data Management for Long Tail Data. Clowder is a customizable and scalable data management framework to support any data format and multiple research domains.

Latest 1.9.7 9 months agoapp version 2.0.0-beta.4 1Artifact Hub

clowder2 1.9.7 deploys 12 container images: bitnamilegacy/minio, bitnamilegacy/mongodb, clowder/clowder2-backend, clowder/clowder2-frontend and 8 more. Across them, 3,295 findings — 14 critical, 33 high — 12 on CISA KEV. The highest contribution is GHSA-f58c-gq56-vjjf in tika-core 2.7.0, fixed in 3.2.2.

Radar Score

37,44114334772,768

3,295 findings over 12 of 12 images measured

KEV ×12 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

12 images

Image	Tag	Vulnerabilities	Radar Score
bitnamilegacy/minio	2023.12.23	0226180	2,291
bitnamilegacy/mongodb	5.0.10	1631206	2,886
clowder/clowder2-backend	2.0.0-beta.4	0246242	3,257
clowder/clowder2-frontend	2.0.0-beta.4	012074	1,092
clowder/clowder2-heartbeat	2.0.0-beta.4	0246242	3,257
clowder/clowder2-messages	2.0.0-beta.4	0246242	3,257
bitnamilegacy/os-shell×4	12-debian-12-r16	3663307	4,478
bitnamilegacy/elasticsearch×8	8.12.2	76100533	7,621
bitnamilegacy/postgresql	15.5.0	2025125	1,897
library/busybox	1.28	0000	0
bitnamilegacy/keycloak	20.0.5	1359452	5,466
bitnamilegacy/rabbitmq	3.10.8	0315165	1,939

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

1,208 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	GHSA-cpf7-j4cf-vqx4	keycloak-services@20.0.5	no fix listed
Low	BIT-java-2023-21937	java@17.0.6-10-4	1.8.0
Low	BIT-java-2023-21938	java@17.0.6-10-4	1.8.0
Low	BIT-rabbitmq-2025-50200	rabbitmq@3.10.8-1	4.0.8
Low	GHSA-m4j5-5x4r-2xp9	keycloak-services@20.0.5	26.2.8
Low	GHSA-9m57-25v3-79x9	golang.org/x/crypto@v0.17.0	0.52.0
Low	GHSA-65pc-fj4g-8rjx	idna@3.10	3.15
Low	BIT-keycloak-2026-18573	keycloak@20.0.5-6	26.7.3
Low	DEBIAN-CVE-2026-89158	pcre2@10.42-1	10.42-1+deb12u1
Low	GHSA-m9gh-789g-q5pv	elasticsearch@8.12.2	8.19.8
Low	DEBIAN-CVE-2011-3374	apt@2.6.1	no fix listed
Low	GO-2023-2041	stdlib@go1.18.2	1.20.8
Low	DEBIAN-CVE-2025-27587	openssl@3.0.17-1~deb12u3	no fix listed
Low	BIT-mongodb-2024-6375	mongodb@5.0.10-0	5.0.22
Low	BIT-java-2026-46968	java@17.0.6-10-4	1.8.0
Low	BIT-java-2026-46968	Java@17.0.10-13-2	1.8.0
Low	GHSA-9wx4-h78v-vm56	requests@2.28.2	2.32.0
Low	ALPINE-CVE-2026-42769	openssl@3.5.4-r0	3.5.7-r0
Low	BIT-elasticsearch-2026-56149	Elasticsearch@8.12.2-0	8.19.17
Low	BIT-elasticsearch-2026-56149	elasticsearch@8.12.2-0	8.19.17
Low	GO-2023-2043	stdlib@go1.18.2	1.20.8
Low	DEBIAN-CVE-2013-4392	systemd@252.39-1~deb12u1	no fix listed
Low	BIT-java-2024-21217	java@17.0.6-10-4	1.8.0
Low	BIT-java-2024-21217	Java@17.0.10-13-2	1.8.0
Low	GO-2022-0515	stdlib@go1.18.2	1.17.12
Low	BIT-keycloak-2026-16104	keycloak@20.0.5-6	26.7.3
Low	GO-2023-2186	stdlib@go1.18.2	1.20.11
Low	PYSEC-2025-183	pyjwt@2.6.0	no fix listed
Low	BIT-postgresql-2024-4317	postgresql@15.5.0-42	14.12.0
Low	BIT-postgresql-2024-4317	PostgreSQL@15.5.0-42	14.12.0
Low	BIT-postgresql-2024-10976	postgresql@15.5.0-42	13.17.0
Low	BIT-postgresql-2024-10976	PostgreSQL@15.5.0-42	13.17.0
Low	GHSA-32fw-gq77-f2f2	github.com/eclipse/paho.mqtt.golang@v1.4.3	1.5.1
Low	DLA-4490-1	openssl@1.1.1w-0+deb11u1	1.1.1w-0+deb11u5
Low	GHSA-f6r7-6w34-x2gp	keycloak-ldap-federation@20.0.5	26.6.3
Low	GO-2024-3333	golang.org/x/net@v0.19.0	0.33.0
Low	ALPINE-CVE-2026-78408	util-linux@2.41-r9	2.41.6-r1
Low	DEBIAN-CVE-2026-78408	util-linux@2.38.1-5+deb12u3	no fix listed
Low	GHSA-hgj6-7826-r7m5	jackson-databind@2.13.4.2	2.18.8
Low	DEBIAN-CVE-2026-41989	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1
Low	DEBIAN-CVE-2024-11053	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u10
Low	BIT-mongodb-2024-8207	mongodb@5.0.10-0	5.0.26
Low	GO-2024-3105	stdlib@go1.20.13	1.22.7
Low	GO-2022-1095	stdlib@go1.18.2	1.18.8
Low	BIT-java-2026-62574	java@17.0.6-10-4	1.8.0
Low	BIT-java-2026-62574	Java@17.0.10-13-2	1.8.0
Low	DEBIAN-CVE-2026-49839	jq@1.6-2.1	1.6-2.1+deb12u2
Low	BIT-java-2023-21968	java@17.0.6-10-4	1.8.0
Low	BIT-java-2024-21131	java@17.0.6-10-4	1.8.0
Low	BIT-java-2024-21131	Java@17.0.10-13-2	1.8.0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
1.9.7latest	9 months ago	2.0.0-beta.4	14334772,768	37,441

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/ncsa/clowder2.svg)](https://charts.stackradar.io/charts/ncsa/clowder2)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.