clowder2 Helm chart

Name: clowder2 Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

ncsa

Scored 15 Sept 2026

Open Source Data Management for Long Tail Data. Clowder is a customizable and scalable data management framework to support any data format and multiple research domains.

Latest 1.9.7 9 months agoapp version 2.0.0-beta.4 1Artifact Hub

clowder2 1.9.7 deploys 12 container images: bitnamilegacy/minio, bitnamilegacy/mongodb, clowder/clowder2-backend, clowder/clowder2-frontend and 8 more. Across them, 3,295 findings — 14 critical, 33 high — 12 on CISA KEV. The highest contribution is GHSA-f58c-gq56-vjjf in tika-core 2.7.0, fixed in 3.2.2.

Radar Score

37,44114334772,768

3,295 findings over 12 of 12 images measured

KEV ×12 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

12 images

Image	Tag	Vulnerabilities	Radar Score
bitnamilegacy/minio	2023.12.23	0226180	2,291
bitnamilegacy/mongodb	5.0.10	1631206	2,886
clowder/clowder2-backend	2.0.0-beta.4	0246242	3,257
clowder/clowder2-frontend	2.0.0-beta.4	012074	1,092
clowder/clowder2-heartbeat	2.0.0-beta.4	0246242	3,257
clowder/clowder2-messages	2.0.0-beta.4	0246242	3,257
bitnamilegacy/os-shell×4	12-debian-12-r16	3663307	4,478
bitnamilegacy/elasticsearch×8	8.12.2	76100533	7,621
bitnamilegacy/postgresql	15.5.0	2025125	1,897
library/busybox	1.28	0000	0
bitnamilegacy/keycloak	20.0.5	1359452	5,466
bitnamilegacy/rabbitmq	3.10.8	0315165	1,939

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

1,208 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	DEBIAN-CVE-2023-29383	shadow@1:4.13+dfsg1-1+b1	1:4.13+dfsg1-1+deb12u1
Low	GHSA-2hm2-hc3v-44h9	mistune@3.0.2	3.3.0
Low	DEBIAN-CVE-2026-90781	alsa-lib@1.2.8-1+b1	no fix listed
Low	GHSA-29wx-vh33-7x7r	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.1
Low	GO-2026-5025	golang.org/x/net@v0.19.0	0.55.0
Low	GO-2026-4970	stdlib@go1.20.13	1.25.12
Low	GHSA-jfvp-7x6p-h2pv	github.com/opencontainers/runc@v1.1.0	1.1.14
Low	GHSA-vffw-93wf-4j4q	python-multipart@0.0.6	0.0.30
Low	DEBIAN-CVE-2025-15224	curl@7.88.1-10+deb12u5	no fix listed
Low	DEBIAN-CVE-2026-22185	openldap@2.5.13+dfsg-5	no fix listed
Low	GO-2026-5027	golang.org/x/net@v0.19.0	0.55.0
Low	GO-2026-5029	golang.org/x/net@v0.19.0	0.55.0
Low	GO-2026-5030	golang.org/x/net@v0.19.0	0.55.0
Low	GHSA-58qw-9mgm-455v	pip@23.0.1	26.1
Low	GHSA-5545-r4hg-rj4m	keycloak-quarkus-server@20.0.5	26.0.6
Low	DEBIAN-CVE-2026-3713	libpng1.6@1.6.39-2	no fix listed
Low	DEBIAN-CVE-2026-42250	bzip2@1.0.8-5+b1	no fix listed
Low	BIT-java-2026-22018	Java@17.0.10-13-2	1.8.0
Low	BIT-java-2026-22018	java@17.0.6-10-4	1.8.0
Low	DEBIAN-CVE-2025-9820	gnutls28@3.7.9-2+deb12u5	3.7.9-2+deb12u6
Low	BIT-java-2026-60589	java@17.0.6-10-4	1.8.0
Low	BIT-java-2026-60589	Java@17.0.10-13-2	1.8.0
Low	DEBIAN-CVE-2026-43895	jq@1.6-2.1	1.6-2.1+deb12u2
Low	GHSA-6jv3-5f52-599m	python-multipart@0.0.6	0.0.30
Low	BIT-postgresql-2026-14666	postgresql@15.5.0-42	14.24.0
Low	BIT-postgresql-2026-14666	PostgreSQL@15.5.0-42	14.24.0
Low	BIT-java-2026-47010	java@17.0.6-10-4	1.8.0
Low	BIT-java-2026-47010	Java@17.0.10-13-2	1.8.0
Low	GO-2026-4602	stdlib@go1.20.13	1.25.8
Low	GHSA-5v8v-xvjv-57x7	keycloak-services@20.0.5	26.4.13
Low	GHSA-c25h-c27q-5qpv	keycloak-ldap-federation@20.0.5	22.0.12
Low	ALPINE-CVE-2026-27456	util-linux@2.41-r9	2.41.6-r0
Low	DEBIAN-CVE-2026-27456	util-linux@2.38.1-5+deb12u3	no fix listed
Low	DEBIAN-CVE-2026-18508	tar@1.34+dfsg-1.2+deb12u1	no fix listed
Low	DEBIAN-CVE-2025-68972	gnupg2@2.2.40-1.1+deb12u1	no fix listed
Low	GHSA-7fpj-9hr8-28vh	keycloak-services@20.0.5	22.0.10
Low	GHSA-63v5-26vq-m4vm	keycloak-services@20.0.5	no fix listed
Low	DEBIAN-CVE-2026-89160	pcre2@10.42-1	10.42-1+deb12u1
Low	BIT-postgresql-2024-10977	postgresql@15.5.0-42	12.21.0
Low	BIT-postgresql-2024-10977	PostgreSQL@15.5.0-42	12.21.0
Low	BIT-mongodb-2025-6707	mongodb@5.0.10-0	5.0.31
Low	BIT-postgresql-2026-16241	PostgreSQL@15.5.0-42	14.24.0
Low	BIT-postgresql-2026-16241	postgresql@15.5.0-42	14.24.0
Low	GHSA-gg57-587f-h5v6	infinispan-core@13.0.10.Final	14.0.25.Final
Low	GHSA-gg57-587f-h5v6	infinispan-commons@13.0.10.Final	14.0.25.Final
Low	GHSA-gg57-587f-h5v6	infinispan-client-hotrod@13.0.10.Final	14.0.25.Final
Low	GHSA-gg57-587f-h5v6	infinispan-cachestore-remote@13.0.10.Final	14.0.25.Final
Low	DEBIAN-CVE-2022-3219	gnupg2@2.2.40-1.1+deb12u1	no fix listed
Low	BIT-postgresql-2026-6469	postgresql@15.5.0-42	14.24.0
Low	BIT-postgresql-2026-6469	PostgreSQL@15.5.0-42	14.24.0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
1.9.7latest	9 months ago	2.0.0-beta.4	14334772,768	37,441

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/ncsa/clowder2.svg)](https://charts.stackradar.io/charts/ncsa/clowder2)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.