clowder2 Helm chart

Name: clowder2 Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

ncsa

Scored 14 Sept 2026

Open Source Data Management for Long Tail Data. Clowder is a customizable and scalable data management framework to support any data format and multiple research domains.

Latest 1.9.7 9 months agoapp version 2.0.0-beta.4 1Artifact Hub

clowder2 1.9.7 deploys 12 container images: bitnamilegacy/minio, bitnamilegacy/mongodb, clowder/clowder2-backend, clowder/clowder2-frontend and 8 more. Across them, 3,298 findings — 14 critical, 33 high — 12 on CISA KEV. The highest contribution is GHSA-f58c-gq56-vjjf in tika-core 2.7.0, fixed in 3.2.2.

Radar Score

37,37314334692,779

3,298 findings over 12 of 12 images measured

KEV ×12 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

12 images

Image	Tag	Vulnerabilities	Radar Score
bitnamilegacy/minio	2023.12.23	0226180	2,291
bitnamilegacy/mongodb	5.0.10	1631206	2,886
clowder/clowder2-backend	2.0.0-beta.4	0246243	3,250
clowder/clowder2-frontend	2.0.0-beta.4	012074	1,091
clowder/clowder2-heartbeat	2.0.0-beta.4	0246243	3,250
clowder/clowder2-messages	2.0.0-beta.4	0246243	3,250
bitnamilegacy/os-shell×4	12-debian-12-r16	3662308	4,456
bitnamilegacy/elasticsearch×8	8.12.2	7695538	7,598
bitnamilegacy/postgresql	15.5.0	2025125	1,897
library/busybox	1.28	0000	0
bitnamilegacy/keycloak	20.0.5	1357454	5,465
bitnamilegacy/rabbitmq	3.10.8	0315165	1,939

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

1,214 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	GHSA-6qvw-249j-h44c	jose4j@0.7.11	0.9.4
Low	BIT-elasticsearch-2024-52981	Elasticsearch@8.12.2-0	7.17.24
Low	BIT-elasticsearch-2024-52981	elasticsearch@8.12.2-0	7.17.24
Low	GHSA-6mq8-rvhq-8wgg	aiohttp@3.11.10	3.13.3
Low	GHSA-hf67-5vvq-fm3r	keycloak-services@20.0.5	26.6.2
Low	GHSA-c4c3-7fpv-j4q5	netty-handler@4.1.86.Final	4.1.137.Final
Low	DEBIAN-CVE-2026-80230	curl@7.88.1-10+deb12u5	no fix listed
Low	BIT-minio-2026-41145	minio@2023.12.23-1	no fix listed
Low	BIT-minio-2026-41145	MinIO@2023.12.23-1	no fix listed
Low	BIT-postgresql-2026-15741	postgresql@15.5.0-42	14.24.0
Low	BIT-postgresql-2026-15741	PostgreSQL@15.5.0-42	14.24.0
Low	GHSA-jmj6-p2j9-68cp	wildfly-elytron@1.20.1.Final	1.20.3.Final
Low	DEBIAN-CVE-2026-42013	gnutls28@3.7.9-2+deb12u5	3.7.9-2+deb12u7
Low	GHSA-69fp-7c8p-crjr	keycloak-services@20.0.5	24.0.5
Low	ALPINE-CVE-2026-76641	expat@2.7.3-r0	2.8.4-r0
Low	DEBIAN-CVE-2026-0861	glibc@2.36-9+deb12u13	2.36-9+deb12u14
Low	BIT-mongodb-2024-3372	mongodb@5.0.10-0	5.0.25
Low	GHSA-9c4q-hq6p-c237	github.com/minio/minio@v0.0.0-20231223071911-496027b589c2	no fix listed
Low	DEBIAN-CVE-2026-3833	gnutls28@3.7.9-2+deb12u5	3.7.9-2+deb12u7
Low	DEBIAN-CVE-2024-2236	libgcrypt20@1.10.1-3	no fix listed
Low	ALPINE-CVE-2026-31789	openssl@3.5.4-r0	3.5.6-r0
Low	DEBIAN-CVE-2026-31789	openssl@3.0.17-1~deb12u3	3.0.19-1~deb12u2
Low	ALPINE-CVE-2025-69419	openssl@3.5.4-r0	3.5.5-r0
Low	DEBIAN-CVE-2025-69419	openssl@3.0.17-1~deb12u3	3.0.18-1~deb12u2
Low	GHSA-x4p7-7chp-64hq	keycloak-server-spi-private@20.0.5	26.5.5
Low	GHSA-x4p7-7chp-64hq	keycloak-services@20.0.5	26.5.5
Low	DEBIAN-CVE-2025-48060	jq@1.6-2.1	1.6-2.1+deb12u1
Low	GHSA-6c5v-hqjr-5xxp	github.com/rabbitmq/amqp091-go@v1.9.0	1.13.0
Low	ALPINE-CVE-2026-54874	openssl@3.5.4-r0	3.5.8-r0
Low	DEBIAN-CVE-2026-54874	openssl@3.0.17-1~deb12u3	no fix listed
Low	BIT-postgresql-2026-6475	PostgreSQL@15.5.0-42	14.23.0
Low	BIT-postgresql-2026-6475	postgresql@15.5.0-42	14.23.0
Low	BIT-postgresql-2023-5868	PostgreSQL@15.5.0-42	11.22.0
Low	BIT-postgresql-2023-5868	postgresql@15.5.0-42	11.22.0
Low	GHSA-qw9x-cqr3-wc7r	github.com/opencontainers/runc@v1.1.0	1.2.8
Low	GHSA-cgrx-mc8f-2prm	github.com/opencontainers/runc@v1.1.0	1.2.8
Low	GHSA-h4wv-g838-66g3	keycloak-services@20.0.5	26.5.7
Low	GHSA-gc7q-jgjv-vjr2	keycloak-services@20.0.5	22.0.12
Low	ALPINE-CVE-2026-42766	openssl@3.5.4-r0	3.5.7-r0
Low	DEBIAN-CVE-2026-42766	openssl@3.0.17-1~deb12u3	3.0.20-1~deb12u2
Low	BIT-postgresql-2023-5870	PostgreSQL@15.5.0-42	11.22.0
Low	BIT-postgresql-2023-5870	postgresql@15.5.0-42	11.22.0
Low	GHSA-vp29-5652-4fw9	github.com/coredns/coredns@v1.11.1	1.14.3
Low	DEBIAN-CVE-2025-69720	ncurses@6.4-4	no fix listed
Low	GHSA-63hw-fmq6-xxg2	aiohttp@3.11.10	3.14.1
Low	BIT-java-2023-22081	java@17.0.6-10-4	1.8.0
Low	GO-2021-0264	stdlib@go1.16.7	1.16.10
Low	GHSA-5pvg-856g-cp85	netty-resolver-dns@4.1.86.Final	4.1.135.Final
Low	GO-2022-0969	stdlib@go1.18.2	1.18.6
Low	GHSA-gmj6-6f8f-6699	jinja2@3.1.4	3.1.5

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
1.9.7latest	9 months ago	2.0.0-beta.4	14334692,779	37,373

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/ncsa/clowder2.svg)](https://charts.stackradar.io/charts/ncsa/clowder2)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.