clowder2 Helm chart

Name: clowder2 Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

ncsa

Scored 14 Sept 2026

Open Source Data Management for Long Tail Data. Clowder is a customizable and scalable data management framework to support any data format and multiple research domains.

Latest 1.9.7 9 months agoapp version 2.0.0-beta.4 1Artifact Hub

clowder2 1.9.7 deploys 12 container images: bitnamilegacy/minio, bitnamilegacy/mongodb, clowder/clowder2-backend, clowder/clowder2-frontend and 8 more. Across them, 3,298 findings — 14 critical, 33 high — 12 on CISA KEV. The highest contribution is GHSA-f58c-gq56-vjjf in tika-core 2.7.0, fixed in 3.2.2.

Radar Score

37,37314334692,779

3,298 findings over 12 of 12 images measured

KEV ×12 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

12 images

Image	Tag	Vulnerabilities	Radar Score
bitnamilegacy/minio	2023.12.23	0226180	2,291
bitnamilegacy/mongodb	5.0.10	1631206	2,886
clowder/clowder2-backend	2.0.0-beta.4	0246243	3,250
clowder/clowder2-frontend	2.0.0-beta.4	012074	1,091
clowder/clowder2-heartbeat	2.0.0-beta.4	0246243	3,250
clowder/clowder2-messages	2.0.0-beta.4	0246243	3,250
bitnamilegacy/os-shell×4	12-debian-12-r16	3662308	4,456
bitnamilegacy/elasticsearch×8	8.12.2	7695538	7,598
bitnamilegacy/postgresql	15.5.0	2025125	1,897
library/busybox	1.28	0000	0
bitnamilegacy/keycloak	20.0.5	1357454	5,465
bitnamilegacy/rabbitmq	3.10.8	0315165	1,939

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

1,463 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	GHSA-g2j6-57v7-gm8c	github.com/opencontainers/runc@v1.1.0	1.1.5
Low	BIT-elasticsearch-2025-37731	elasticsearch@8.12.2-0	8.19.8
Low	BIT-elasticsearch-2025-37731	Elasticsearch@8.12.2-0	8.19.8
Low	GHSA-qc2q-p7wx-3px3	google.golang.org/grpc@v1.60.1	1.83.1
Low	GHSA-qfrw-5rxm-mhh2	mistune@3.0.2	3.3.0
Low	GO-2023-2382	stdlib@go1.18.2	1.20.12
Low	DEBIAN-CVE-2026-6429	curl@7.88.1-10+deb12u5	no fix listed
Low	GHSA-hpj7-wq8m-9hgp	aiohttp@3.11.10	3.14.1
Low	GO-2022-1143	stdlib@go1.18.2	1.18.9
Low	GHSA-qpw4-5x99-6vjp	golang.org/x/crypto@v0.17.0	0.52.0
Low	DEBIAN-CVE-2024-22365	pam@1.5.2-6+deb12u1	1.5.2-6+deb12u2
Low	GHSA-c69g-56f8-xwqj	netty-codec-http2@4.1.86.Final	4.1.136.Final
Low	ALPINE-CVE-2026-22796	openssl@3.5.4-r0	3.5.5-r0
Low	DEBIAN-CVE-2026-22796	openssl@3.0.17-1~deb12u3	3.0.18-1~deb12u2
Low	GHSA-f6x5-jh6r-wrfv	golang.org/x/crypto@v0.17.0	0.45.0
Low	GHSA-4f53-xh3v-g8x4	keycloak-services@20.0.5	22.0.10
Low	GHSA-78mq-xcr3-xm33	golang.org/x/crypto@v0.17.0	0.52.0
Low	GHSA-xv6h-r36f-3gp5	keycloak-saml-core@20.0.5	26.5.4
Low	GHSA-xv6h-r36f-3gp5	keycloak-services@20.0.5	26.5.4
Low	GHSA-9623-mj7j-p9v4	quarkus-vertx@2.13.7.Final	3.15.6
Low	GO-2024-2599	stdlib@go1.20.13	1.21.8
Low	BIT-java-2023-22049	java@17.0.6-10-4	1.8.0
Low	DEBIAN-CVE-2025-10148	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15
Low	GHSA-m32f-8vh9-2hh3	keycloak-services@20.0.5	no fix listed
Low	PYSEC-2026-2214	mistune@3.0.2	3.3.0
Low	GHSA-33j3-g875-37rp	keycloak-services@20.0.5	no fix listed
Low	GO-2022-1038	stdlib@go1.18.2	1.18.7
Low	GHSA-4hx9-48xh-5mxr	keycloak-ldap-federation@20.0.5	26.2.11
Low	DEBIAN-CVE-2024-26462	krb5@1.20.1-2+deb12u1	1.20.1-2+deb12u3
Low	DEBIAN-CVE-2026-22695	libpng1.6@1.6.39-2	1.6.39-2+deb12u2
Low	GO-2024-3106	stdlib@go1.20.13	1.22.7
Low	DEBIAN-CVE-2024-2004	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u6
Low	GHSA-c427-h43c-vf67	aiohttp@3.11.10	3.13.4
Low	GHSA-hjcp-jmpx-g3qm	httpclient5@5.0.3	5.6.3
Low	DEBIAN-CVE-2026-1965	curl@7.88.1-10+deb12u5	no fix listed
Low	GO-2023-1570	stdlib@go1.18.2	1.19.6
Low	DEBIAN-CVE-2022-0563	util-linux@2.38.1-5+deb12u3	no fix listed
Low	GHSA-9f5j-8jwj-x28g	ecdsa@0.19.0	0.19.2
Low	DEBIAN-CVE-2025-3576	krb5@1.20.1-2+deb12u1	1.20.1-2+deb12u4
Low	DEBIAN-CVE-2026-4878	libcap2@1:2.66-4+deb12u2	1:2.66-4+deb12u3
Low	GHSA-xvr9-35cr-46v9	mariadb-java-client@3.0.8	3.3.5
Low	DEBIAN-CVE-2026-7168	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15
Low	BIT-postgresql-2025-12818	postgresql@15.5.0-42	13.23.0
Low	BIT-postgresql-2025-12818	PostgreSQL@15.5.0-42	13.23.0
Low	PYSEC-2026-2104	aiohttp@3.11.10	3.14.0
Low	DSA-5391-1	libxml2@2.9.10+dfsg-6.7+deb11u3	2.9.10+dfsg-6.7+deb11u4
Low	BIT-java-2024-21011	Java@17.0.10-13-2	1.8.0
Low	BIT-java-2024-21011	java@17.0.6-10-4	1.8.0
Low	BIT-java-2023-22044	java@17.0.6-10-4	17.0.8
Low	GO-2022-0531	stdlib@go1.18.2	1.17.11

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
1.9.7latest	9 months ago	2.0.0-beta.4	14334692,779	37,373

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/ncsa/clowder2.svg)](https://charts.stackradar.io/charts/ncsa/clowder2)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.