clowder2 Helm chart

Name: clowder2 Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

ncsa

Scored 15 Sept 2026

Open Source Data Management for Long Tail Data. Clowder is a customizable and scalable data management framework to support any data format and multiple research domains.

Latest 1.9.7 9 months agoapp version 2.0.0-beta.4 1Artifact Hub

clowder2 1.9.7 deploys 12 container images: bitnamilegacy/minio, bitnamilegacy/mongodb, clowder/clowder2-backend, clowder/clowder2-frontend and 8 more. Across them, 3,295 findings — 14 critical, 33 high — 12 on CISA KEV. The highest contribution is GHSA-f58c-gq56-vjjf in tika-core 2.7.0, fixed in 3.2.2.

Radar Score

37,44114334772,768

3,295 findings over 12 of 12 images measured

KEV ×12 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

12 images

Image	Tag	Vulnerabilities	Radar Score
bitnamilegacy/minio	2023.12.23	0226180	2,291
bitnamilegacy/mongodb	5.0.10	1631206	2,886
clowder/clowder2-backend	2.0.0-beta.4	0246242	3,257
clowder/clowder2-frontend	2.0.0-beta.4	012074	1,092
clowder/clowder2-heartbeat	2.0.0-beta.4	0246242	3,257
clowder/clowder2-messages	2.0.0-beta.4	0246242	3,257
bitnamilegacy/os-shell×4	12-debian-12-r16	3663307	4,478
bitnamilegacy/elasticsearch×8	8.12.2	76100533	7,621
bitnamilegacy/postgresql	15.5.0	2025125	1,897
library/busybox	1.28	0000	0
bitnamilegacy/keycloak	20.0.5	1359452	5,466
bitnamilegacy/rabbitmq	3.10.8	0315165	1,939

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

1,462 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	DEBIAN-CVE-2022-3219	gnupg2@2.2.40-1.1+deb12u1	no fix listed
Low	BIT-postgresql-2026-6469	PostgreSQL@15.5.0-42	14.24.0
Low	BIT-postgresql-2026-6469	postgresql@15.5.0-42	14.24.0
Low	DLA-4319-1	libxml2@2.9.10+dfsg-6.7+deb11u3	2.9.10+dfsg-6.7+deb11u9
Low	ALPINE-CVE-2026-41080	expat@2.7.3-r0	2.8.1-r0
Low	BIT-postgresql-2026-14673	PostgreSQL@15.5.0-42	14.24.0
Low	BIT-postgresql-2026-14673	postgresql@15.5.0-42	14.24.0
Low	DEBIAN-CVE-2023-4016	procps@2:4.0.2-3	no fix listed
Low	GHSA-22rm-wp4x-v5cx	keycloak-services@20.0.5	26.4.13
Low	GHSA-m2w5-7xhv-w6fh	keycloak-services@20.0.5	no fix listed
Low	GHSA-w573-9ffj-6ff9	netty-transport-native-epoll@4.1.86.Final	4.1.135.Final
Low	ALPINE-CVE-2025-69418	openssl@3.5.4-r0	3.5.5-r0
Low	DEBIAN-CVE-2025-69418	openssl@3.0.17-1~deb12u3	3.0.18-1~deb12u2
Low	DEBIAN-CVE-2007-5686	shadow@1:4.13+dfsg1-1+deb12u1	no fix listed
Low	GHSA-g78x-7vwx-9f58	keycloak-services@20.0.5	26.4.9
Low	GHSA-j75r-vf64-6rrh	resteasy-reactive-common@2.13.7.Final	3.0.0.Alpha4
Low	GO-2026-5024	golang.org/x/sys@v0.15.0	0.44.0
Low	GHSA-6q37-7866-h27j	keycloak-services@20.0.5	26.5.0
Low	GHSA-6g26-7cx5-mrrg	keycloak-services@20.0.5	26.7.0
Low	DEBIAN-CVE-2026-18477	tar@1.34+dfsg-1.2+deb12u1	no fix listed
Low	BIT-postgresql-2025-12817	PostgreSQL@15.5.0-42	13.23.0
Low	BIT-postgresql-2025-12817	postgresql@15.5.0-42	13.23.0
Low	BIT-postgresql-2025-8713	PostgreSQL@15.5.0-42	13.22.0
Low	BIT-postgresql-2025-8713	postgresql@15.5.0-42	13.22.0
Low	GHSA-xjvp-4fhw-gc47	github.com/opencontainers/runc@v1.1.0	1.3.6
Low	GHSA-594w-2fwp-jwrc	keycloak-services@20.0.5	no fix listed
Low	GHSA-xh32-c9wx-phrp	keycloak-services@20.0.5	no fix listed
Low	DEBIAN-CVE-2026-53613	util-linux@2.38.1-5+deb12u3	no fix listed
Low	DEBIAN-CVE-2026-53615	util-linux@2.38.1-5+deb12u3	no fix listed
Low	DEBIAN-CVE-2026-77117	glibc@2.36-9+deb12u13	no fix listed
Low	DEBIAN-CVE-2026-80489	glibc@2.36-9+deb12u13	no fix listed
Low	DLA-3972-1	tzdata@2021a-1+deb11u11	2024b-0+deb11u1
Low	DLA-4085-1	tzdata@2021a-1+deb11u11	2025a-0+deb11u1
Low	DLA-4105-1	tzdata@2021a-1+deb11u11	2025b-0+deb11u1
Low	DLA-4213-1	curl@7.74.0-1.3+deb11u11	7.74.0-1.3+deb11u15
Low	DLA-4403-1	tzdata@2021a-1+deb11u11	2025b-0+deb11u2
Low	DLA-4485-1	ca-certificates@20210119	20230311+deb12u1~deb11u1
Low	GO-2026-5841	github.com/klauspost/compress@v1.17.4	1.18.7
Low	GO-2026-5932	golang.org/x/crypto@v0.17.0	no fix listed
Low	GO-2026-6061	google.golang.org/grpc@v1.60.1	1.82.1
Low	GO-2026-6278	github.com/gorilla/websocket@v1.5.1	1.5.3
Low	ALPINE-CVE-2025-46394	busybox@1.37.0-r19	1.37.0-r20
Low	DEBIAN-CVE-2026-40228	systemd@252.39-1~deb12u1	no fix listed
Low	BIT-keycloak-2025-12150	keycloak@20.0.5-6	26.4.4
Low	GHSA-7g5x-9c4v-4w5r	keycloak-services@20.0.5	26.4.4
Low	GHSA-fghv-69vj-qj49	netty-codec-http@4.1.86.Final	4.1.125.Final
Low	GHSA-8hc5-rmgf-qx6p	keycloak-ldap-federation@20.0.5	23.0.1
Low	GHSA-8hc5-rmgf-qx6p	keycloak-services@20.0.5	23.0.1
Low	GHSA-m8cg-xc2p-r3fc	github.com/opencontainers/runc@v1.1.0	1.1.5
Low	DEBIAN-CVE-2026-57062	gnupg2@2.2.40-1.1+deb12u1	no fix listed

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
1.9.7latest	9 months ago	2.0.0-beta.4	14334772,768	37,441

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/ncsa/clowder2.svg)](https://charts.stackradar.io/charts/ncsa/clowder2)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.