clowder2 Helm chart

Name: clowder2 Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

ncsa

Scored 14 Sept 2026

Open Source Data Management for Long Tail Data. Clowder is a customizable and scalable data management framework to support any data format and multiple research domains.

Latest 1.9.7 9 months agoapp version 2.0.0-beta.4 1Artifact Hub

clowder2 1.9.7 deploys 12 container images: bitnamilegacy/minio, bitnamilegacy/mongodb, clowder/clowder2-backend, clowder/clowder2-frontend and 8 more. Across them, 3,298 findings — 14 critical, 33 high — 12 on CISA KEV. The highest contribution is GHSA-f58c-gq56-vjjf in tika-core 2.7.0, fixed in 3.2.2.

Radar Score

37,37314334692,779

3,298 findings over 12 of 12 images measured

KEV ×12 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

12 images

Image	Tag	Vulnerabilities	Radar Score
bitnamilegacy/minio	2023.12.23	0226180	2,291
bitnamilegacy/mongodb	5.0.10	1631206	2,886
clowder/clowder2-backend	2.0.0-beta.4	0246243	3,250
clowder/clowder2-frontend	2.0.0-beta.4	012074	1,091
clowder/clowder2-heartbeat	2.0.0-beta.4	0246243	3,250
clowder/clowder2-messages	2.0.0-beta.4	0246243	3,250
bitnamilegacy/os-shell×4	12-debian-12-r16	3662308	4,456
bitnamilegacy/elasticsearch×8	8.12.2	7695538	7,598
bitnamilegacy/postgresql	15.5.0	2025125	1,897
library/busybox	1.28	0000	0
bitnamilegacy/keycloak	20.0.5	1357454	5,465
bitnamilegacy/rabbitmq	3.10.8	0315165	1,939

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

1,463 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	GHSA-h8mm-c463-wjq3	github.com/coredns/coredns@v1.11.1	1.14.3
Low	ALPINE-CVE-2026-75803	openssl@3.5.4-r0	3.5.8-r0
Low	DEBIAN-CVE-2026-75803	openssl@3.0.17-1~deb12u3	no fix listed
Low	GHSA-676x-f7gg-47vc	netty-resolver-dns@4.1.86.Final	4.1.135.Final
Low	DEBIAN-CVE-2024-33602	glibc@2.36-9+deb12u4	2.36-9+deb12u7
Low	GHSA-mjmq-gwgm-5qhm	sshd-common@2.9.2	2.9.3
Low	GHSA-jw7r-rxff-gv24	apache-mime4j-core@0.8.3	0.8.10
Low	BIT-postgresql-2026-14679	PostgreSQL@15.5.0-42	14.24.0
Low	BIT-postgresql-2026-14679	postgresql@15.5.0-42	14.24.0
Low	DEBIAN-CVE-2026-4046	glibc@2.36-9+deb12u13	2.36-9+deb12u14
Low	GHSA-xgmm-8j9v-c9wx	pyjwt@2.6.0	2.13.0
Low	GHSA-wg6q-6289-32hp	bcpkix-jdk18on@1.76	1.84
Low	GHSA-wg6q-6289-32hp	bcpkix-jdk15on@1.70	1.84
Low	ALPINE-CVE-2025-15468	openssl@3.5.4-r0	3.5.5-r0
Low	GO-2022-0537	stdlib@go1.18.2	1.17.13
Low	DEBIAN-CVE-2026-58051	libssh2@1.10.0-3+b1	1.10.0-3+deb12u1
Low	GHSA-4h8f-2wvx-gg5w	bcprov-jdk18on@1.76	1.78
Low	GHSA-4h8f-2wvx-gg5w	bcprov-jdk15on@1.70	1.78
Low	GHSA-qhmp-q7xh-99rh	github.com/coredns/coredns@v1.11.1	1.14.3
Low	DEBIAN-CVE-2026-48959	perl@5.36.0-7+deb12u3	no fix listed
Low	DEBIAN-CVE-2026-5928	glibc@2.36-9+deb12u13	no fix listed
Low	GHSA-c5q2-7r4c-mv6g	gopkg.in/square/go-jose.v2@v2.6.0	no fix listed
Low	GHSA-wqp7-x3pw-xc5r	starlette@0.26.1	1.1.0
Low	GHSA-wjxj-5m7g-mg7q	bcprov-jdk15on@1.70	no fix listed
Low	DEBIAN-CVE-2026-40164	jq@1.6-2.1	1.6-2.1+deb12u2
Low	GHSA-vpvm-3wq2-2wvm	github.com/opencontainers/runc@v1.1.0	1.1.5
Low	GHSA-8rmm-gm28-pj8q	keycloak-services@20.0.5	22.0.10
Low	BIT-java-2026-41254	java@17.0.6-10-4	1.8.0
Low	BIT-java-2026-41254	Java@17.0.10-13-2	1.8.0
Low	DEBIAN-CVE-2026-39979	jq@1.6-2.1	1.6-2.1+deb12u2
Low	DEBIAN-CVE-2026-7598	libssh2@1.10.0-3+b1	1.10.0-3+deb12u1
Low	GHSA-pjcq-xvwq-hhpj	github.com/Azure/go-ntlmssp@v0.0.0-20221128193559-754e69321358	0.1.1
Low	DEBIAN-CVE-2026-6791	glibc@2.36-9+deb12u13	no fix listed
Low	DEBIAN-CVE-2022-27943	gcc-12@12.2.0-14+deb12u1	no fix listed
Low	GHSA-j628-q885-8gr5	keycloak-services@20.0.5	22.0.9
Low	GHSA-4265-ccf5-phj5	commons-compress@1.21	1.26.0
Low	ALPINE-CVE-2025-64720	libpng@1.6.47-r0	1.6.51-r0
Low	DEBIAN-CVE-2025-64720	libpng1.6@1.6.39-2	1.6.39-2+deb12u1
Low	DEBIAN-CVE-2026-8458	curl@7.88.1-10+deb12u5	no fix listed
Low	BIT-postgresql-2025-4207	PostgreSQL@15.5.0-42	13.21.0
Low	BIT-postgresql-2025-4207	postgresql@15.5.0-42	13.21.0
Low	DEBIAN-CVE-2026-6253	curl@7.88.1-10+deb12u5	no fix listed
Low	GHSA-w5gg-2q56-6h4f	elasticsearch@8.12.2	8.13.0
Low	BIT-elasticsearch-2024-52980	elasticsearch@8.12.2-0	8.15.1
Low	BIT-elasticsearch-2024-52980	Elasticsearch@8.12.2-0	8.15.1
Low	GHSA-ghfh-p92w-j4mg	elasticsearch@8.12.2	8.15.1
Low	GHSA-m4p7-r5rc-7g4j	pyasn1@0.6.1	0.6.4
Low	DLA-4251-1	libxml2@2.9.10+dfsg-6.7+deb11u3	2.9.10+dfsg-6.7+deb11u8
Low	GHSA-22wj-vf5f-wrvj	h2@2.1.214	2.2.220
Low	GO-2023-1703	stdlib@go1.18.2	1.19.8

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
1.9.7latest	9 months ago	2.0.0-beta.4	14334692,779	37,373

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/ncsa/clowder2.svg)](https://charts.stackradar.io/charts/ncsa/clowder2)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.