clowder2 Helm chart

Name: clowder2 Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

ncsa

Scored 14 Sept 2026

Open Source Data Management for Long Tail Data. Clowder is a customizable and scalable data management framework to support any data format and multiple research domains.

Latest 1.9.7 9 months agoapp version 2.0.0-beta.4 1Artifact Hub

clowder2 1.9.7 deploys 12 container images: bitnamilegacy/minio, bitnamilegacy/mongodb, clowder/clowder2-backend, clowder/clowder2-frontend and 8 more. Across them, 3,298 findings — 14 critical, 33 high — 12 on CISA KEV. The highest contribution is GHSA-f58c-gq56-vjjf in tika-core 2.7.0, fixed in 3.2.2.

Radar Score

37,37314334692,779

3,298 findings over 12 of 12 images measured

KEV ×12 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

12 images

Image	Tag	Vulnerabilities	Radar Score
bitnamilegacy/minio	2023.12.23	0226180	2,291
bitnamilegacy/mongodb	5.0.10	1631206	2,886
clowder/clowder2-backend	2.0.0-beta.4	0246243	3,250
clowder/clowder2-frontend	2.0.0-beta.4	012074	1,091
clowder/clowder2-heartbeat	2.0.0-beta.4	0246243	3,250
clowder/clowder2-messages	2.0.0-beta.4	0246243	3,250
bitnamilegacy/os-shell×4	12-debian-12-r16	3662308	4,456
bitnamilegacy/elasticsearch×8	8.12.2	7695538	7,598
bitnamilegacy/postgresql	15.5.0	2025125	1,897
library/busybox	1.28	0000	0
bitnamilegacy/keycloak	20.0.5	1357454	5,465
bitnamilegacy/rabbitmq	3.10.8	0315165	1,939

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

1,463 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	DEBIAN-CVE-2026-78409	util-linux@2.38.1-5+deb12u3	no fix listed
Low	DLA-4492-1	gnutls28@3.7.1-5+deb11u3	3.7.1-5+deb11u9
Low	DEBIAN-CVE-2024-13176	openssl@3.0.11-1~deb12u2	3.0.16-1~deb12u1
Low	GHSA-2v4p-qf9q-27wj	google.golang.org/grpc@v1.60.1	1.82.2
Low	GHSA-xpw8-rcwv-8f8p	netty-codec-http2@4.1.86.Final	4.1.100.Final
Low	DEBIAN-CVE-2023-4641	shadow@1:4.13+dfsg1-1+b1	1:4.13+dfsg1-1+deb12u1
Low	GHSA-r3hx-qfh5-r9m7	elasticsearch@8.12.2	8.13.0
Low	BIT-java-2026-22013	Java@17.0.10-13-2	1.8.0
Low	BIT-java-2026-22013	java@17.0.6-10-4	1.8.0
Low	BIT-keycloak-2026-17048	keycloak@20.0.5-6	26.7.2
Low	GHSA-jgwc-jh89-rpgq	keycloak-quarkus-server@20.0.5	no fix listed
Low	BIT-java-2026-70907	Java@17.0.10-13-2	1.8.0
Low	BIT-java-2026-70907	java@17.0.6-10-4	1.8.0
Low	ALPINE-CVE-2026-45446	openssl@3.5.4-r0	3.5.7-r0
Low	DEBIAN-CVE-2026-45446	openssl@3.0.17-1~deb12u3	3.0.20-1~deb12u2
Low	BIT-gdal-2026-49014	GDAL@3.8.3	3.13.1
Low	GHSA-7g45-4rm6-3mm3	guava@30.1-jre	32.0.0-android
Low	BIT-java-2024-21210	Java@17.0.10-13-2	1.8.0
Low	BIT-java-2024-21210	java@17.0.6-10-4	1.8.0
Low	BIT-gdal-2026-8088	GDAL@3.8.3	3.13.0
Low	BIT-keycloak-2026-16072	keycloak@20.0.5-6	26.7.3
Low	GHSA-qxvw-fvwx-5cp7	mariadb-java-client@3.0.8	3.3.5
Low	DLA-4146-1	libxml2@2.9.10+dfsg-6.7+deb11u3	2.9.10+dfsg-6.7+deb11u7
Low	GO-2025-4116	golang.org/x/crypto@v0.17.0	0.43.0
Low	GO-2026-4870	stdlib@go1.20.13	1.25.9
Low	GO-2022-0532	stdlib@go1.18.2	1.17.11
Low	DEBIAN-CVE-2026-39956	jq@1.6-2.1	1.6-2.1+deb12u2
Low	GO-2025-4009	stdlib@go1.20.13	1.24.8
Low	GO-2026-4947	stdlib@go1.20.13	1.25.9
Low	GHSA-xhpr-465j-7p9q	keycloak-services@20.0.5	26.0.13
Low	GHSA-cq42-vhv7-xr7p	keycloak-services@20.0.5	24.0.0
Low	DEBIAN-CVE-2026-33947	jq@1.6-2.1	1.6-2.1+deb12u2
Low	BIT-keycloak-2026-14613	keycloak@20.0.5-6	26.7.2
Low	BIT-keycloak-2026-16106	keycloak@20.0.5-6	26.7.3
Low	GO-2025-4006	stdlib@go1.20.13	1.24.8
Low	BIT-gdal-2026-8213	GDAL@3.8.3	3.13.0
Low	DLA-3930-1	libsepol@3.1-1	3.1-1+deb11u1
Low	ALPINE-CVE-2026-56412	expat@2.7.3-r0	2.8.2-r0
Low	DEBIAN-CVE-2026-33948	jq@1.6-2.1	1.6-2.1+deb12u2
Low	BIT-java-2024-21094	java@17.0.6-10-4	1.8.0
Low	BIT-java-2024-21094	Java@17.0.10-13-2	1.8.0
Low	GO-2026-5037	stdlib@go1.20.13	1.25.11
Low	DEBIAN-CVE-2026-40225	systemd@252.39-1~deb12u1	252.39-1~deb12u2
Low	GO-2026-4971	stdlib@go1.20.13	1.25.10
Low	GHSA-rx66-hj7g-28h7	keycloak-services@20.0.5	26.5.7
Low	ALPINE-CVE-2026-50219	expat@2.7.3-r0	2.8.2-r0
Low	GO-2025-3495	github.com/minio/minio@v0.0.0-20231223071911-496027b589c2	no fix listed
Low	ALPINE-CVE-2026-56409	expat@2.7.3-r0	2.8.2-r0
Low	GHSA-hm32-hfmw-rhvg	keycloak-services@20.0.5	no fix listed
Low	BIT-elasticsearch-2026-56143	Elasticsearch@8.12.2-0	8.19.20

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
1.9.7latest	9 months ago	2.0.0-beta.4	14334692,779	37,373

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/ncsa/clowder2.svg)](https://charts.stackradar.io/charts/ncsa/clowder2)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.