clowder2 Helm chart

Name: clowder2 Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

ncsa

Scored 15 Sept 2026

Open Source Data Management for Long Tail Data. Clowder is a customizable and scalable data management framework to support any data format and multiple research domains.

Latest 1.9.7 9 months agoapp version 2.0.0-beta.4 1Artifact Hub

clowder2 1.9.7 deploys 12 container images: bitnamilegacy/minio, bitnamilegacy/mongodb, clowder/clowder2-backend, clowder/clowder2-frontend and 8 more. Across them, 3,295 findings — 14 critical, 33 high — 12 on CISA KEV. The highest contribution is GHSA-f58c-gq56-vjjf in tika-core 2.7.0, fixed in 3.2.2.

Radar Score

37,44114334772,768

3,295 findings over 12 of 12 images measured

KEV ×12 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

12 images

Image	Tag	Vulnerabilities	Radar Score
bitnamilegacy/minio	2023.12.23	0226180	2,291
bitnamilegacy/mongodb	5.0.10	1631206	2,886
clowder/clowder2-backend	2.0.0-beta.4	0246242	3,257
clowder/clowder2-frontend	2.0.0-beta.4	012074	1,092
clowder/clowder2-heartbeat	2.0.0-beta.4	0246242	3,257
clowder/clowder2-messages	2.0.0-beta.4	0246242	3,257
bitnamilegacy/os-shell×4	12-debian-12-r16	3663307	4,478
bitnamilegacy/elasticsearch×8	8.12.2	76100533	7,621
bitnamilegacy/postgresql	15.5.0	2025125	1,897
library/busybox	1.28	0000	0
bitnamilegacy/keycloak	20.0.5	1359452	5,466
bitnamilegacy/rabbitmq	3.10.8	0315165	1,939

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

1,208 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	DLA-4492-1	gnutls28@3.7.1-5+deb11u3	3.7.1-5+deb11u9
Low	DEBIAN-CVE-2023-4641	shadow@1:4.13+dfsg1-1+b1	1:4.13+dfsg1-1+deb12u1
Low	DEBIAN-CVE-2024-13176	openssl@3.0.11-1~deb12u2	3.0.16-1~deb12u1
Low	GHSA-2v4p-qf9q-27wj	google.golang.org/grpc@v1.60.1	1.82.2
Low	GHSA-xpw8-rcwv-8f8p	netty-codec-http2@4.1.86.Final	4.1.100.Final
Low	GHSA-r3hx-qfh5-r9m7	elasticsearch@8.12.2	8.13.0
Low	BIT-java-2026-22013	java@17.0.6-10-4	1.8.0
Low	BIT-java-2026-22013	Java@17.0.10-13-2	1.8.0
Low	BIT-keycloak-2026-17048	keycloak@20.0.5-6	26.7.2
Low	GHSA-jgwc-jh89-rpgq	keycloak-quarkus-server@20.0.5	no fix listed
Low	BIT-java-2026-70907	java@17.0.6-10-4	1.8.0
Low	BIT-java-2026-70907	Java@17.0.10-13-2	1.8.0
Low	ALPINE-CVE-2026-45446	openssl@3.5.4-r0	3.5.7-r0
Low	DEBIAN-CVE-2026-45446	openssl@3.0.17-1~deb12u3	3.0.20-1~deb12u2
Low	BIT-gdal-2026-49014	GDAL@3.8.3	3.13.1
Low	GHSA-7g45-4rm6-3mm3	guava@30.1-jre	32.0.0-android
Low	BIT-java-2024-21210	Java@17.0.10-13-2	1.8.0
Low	BIT-java-2024-21210	java@17.0.6-10-4	1.8.0
Low	BIT-gdal-2026-8088	GDAL@3.8.3	3.13.0
Low	BIT-keycloak-2026-16072	keycloak@20.0.5-6	26.7.3
Low	GHSA-qxvw-fvwx-5cp7	mariadb-java-client@3.0.8	3.3.5
Low	DLA-4146-1	libxml2@2.9.10+dfsg-6.7+deb11u3	2.9.10+dfsg-6.7+deb11u7
Low	GO-2025-4116	golang.org/x/crypto@v0.17.0	0.43.0
Low	GO-2026-4870	stdlib@go1.20.13	1.25.9
Low	GO-2022-0532	stdlib@go1.18.2	1.17.11
Low	DEBIAN-CVE-2026-39956	jq@1.6-2.1	1.6-2.1+deb12u2
Low	GO-2025-4009	stdlib@go1.20.13	1.24.8
Low	GO-2026-4947	stdlib@go1.20.13	1.25.9
Low	GHSA-xhpr-465j-7p9q	keycloak-services@20.0.5	26.0.13
Low	GHSA-cq42-vhv7-xr7p	keycloak-services@20.0.5	24.0.0
Low	DEBIAN-CVE-2026-33947	jq@1.6-2.1	1.6-2.1+deb12u2
Low	BIT-keycloak-2026-14613	keycloak@20.0.5-6	26.7.2
Low	BIT-keycloak-2026-16106	keycloak@20.0.5-6	26.7.3
Low	GO-2025-4006	stdlib@go1.20.13	1.24.8
Low	BIT-gdal-2026-8213	GDAL@3.8.3	3.13.0
Low	DLA-3930-1	libsepol@3.1-1	3.1-1+deb11u1
Low	ALPINE-CVE-2026-56412	expat@2.7.3-r0	2.8.2-r0
Low	DEBIAN-CVE-2026-33948	jq@1.6-2.1	1.6-2.1+deb12u2
Low	BIT-java-2024-21094	java@17.0.6-10-4	1.8.0
Low	BIT-java-2024-21094	Java@17.0.10-13-2	1.8.0
Low	GO-2026-5037	stdlib@go1.20.13	1.25.11
Low	DEBIAN-CVE-2026-40225	systemd@252.39-1~deb12u1	252.39-1~deb12u2
Low	GO-2026-4971	stdlib@go1.20.13	1.25.10
Low	GHSA-rx66-hj7g-28h7	keycloak-services@20.0.5	26.5.7
Low	ALPINE-CVE-2026-50219	expat@2.7.3-r0	2.8.2-r0
Low	GO-2025-3495	github.com/minio/minio@v0.0.0-20231223071911-496027b589c2	no fix listed
Low	ALPINE-CVE-2026-56409	expat@2.7.3-r0	2.8.2-r0
Low	GHSA-hm32-hfmw-rhvg	keycloak-services@20.0.5	no fix listed
Low	BIT-elasticsearch-2026-56143	Elasticsearch@8.12.2-0	8.19.20
Low	BIT-elasticsearch-2026-56143	elasticsearch@8.12.2-0	8.19.20

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
1.9.7latest	9 months ago	2.0.0-beta.4	14334772,768	37,441

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/ncsa/clowder2.svg)](https://charts.stackradar.io/charts/ncsa/clowder2)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.