fulcio 2.11.2 Helm chart

Name: fulcio Helm chart 2.11.2: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

sigstore

Scored 28 Sept 2026

Fulcio is a free code signing Certificate Authority, built to make short-lived certificates available to anyone.

Version 2.11.2 yesterdayapp version 1.8.8 3Artifact Hub

fulcio 2.11.2 deploys 6 container images: ghcr.io/sigstore/scaffolding/ct_server, ghcr.io/sigstore/fulcio, curlimages/curl, ghcr.io/sigstore/scaffolding/createctconfig and 2 more. Across them, 394 findings — 1 critical, 0 high. The highest contribution is ALPINE-CVE-2025-15467 in openssl 3.5.4-r0, fixed in 3.5.5-r0.

Radar Score

3,5671058335

394 findings over 6 of 6 images measured

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

6 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/sigstore/scaffolding/ct_server	v0.7.31	001479	818
ghcr.io/sigstore/fulcio	v1.8.8	00221	160
curlimages/curl	8.17.0	102231	776
ghcr.io/sigstore/scaffolding/createctconfig	v0.7.31	001076	738
ghcr.io/sigstore/scaffolding/createtree	v0.7.31	00359	458
ghcr.io/sigstore/scaffolding/createcerts	digest-pinned	00769	617

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

119 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	ALPINE-CVE-2026-42764	openssl@3.5.4-r0	3.5.7-r0
Low	ALPINE-CVE-2026-63075	openssl@3.5.4-r0	3.5.8-r0
Low	GHSA-78h2-9frx-2jm8	github.com/go-jose/go-jose/v4@v4.1.3	4.1.4
Low	ALPINE-CVE-2026-14456	openssl@3.5.4-r0	3.5.8-r0
Low	ALPINE-CVE-2026-31789	openssl@3.5.4-r0	3.5.6-r0
Low	ALPINE-CVE-2026-45445	openssl@3.5.4-r0	3.5.7-r0
Low	ALPINE-CVE-2026-55199	libssh2@1.11.1-r0	1.11.1-r2
Low	ALPINE-CVE-2026-7598	libssh2@1.11.1-r0	1.11.1-r1
Low	GHSA-w879-237q-wc7r	golang.org/x/crypto@v0.43.0	0.52.0
Low	GHSA-q4h4-gmj2-qvw2	golang.org/x/crypto@v0.43.0	0.52.0
Low	ALPINE-CVE-2025-69419	openssl@3.5.4-r0	3.5.5-r0
Low	ALPINE-CVE-2026-42766	openssl@3.5.4-r0	3.5.7-r0
Low	ALPINE-CVE-2026-22184	zlib@1.3.1-r2	1.3.2-r0
Low	GHSA-f5mr-q85p-6hh6	github.com/sigstore/fulcio@v1.7.1	1.8.6
Low	GHSA-wg65-39gg-5wfj	github.com/prometheus/prometheus@v0.51.0	0.311.3
Low	ALPINE-CVE-2025-15468	openssl@3.5.4-r0	3.5.5-r0
Low	ALPINE-CVE-2026-75803	openssl@3.5.4-r0	3.5.8-r0
Low	GO-2026-4341	stdlib@go1.25.0	1.24.12
Low	GHSA-45gg-vh54-h5m9	golang.org/x/crypto@v0.43.0	0.52.0
Low	ALPINE-CVE-2026-2673	openssl@3.5.4-r0	3.5.6-r0
Low	GHSA-5cv4-jp36-h3mw	golang.org/x/net@v0.46.0	0.55.0
Low	ALPINE-CVE-2026-63074	openssl@3.5.4-r0	3.5.8-r0
Low	GHSA-fw7p-63qq-7hpr	filippo.io/edwards25519@v1.1.0	1.1.1
Low	GHSA-78mq-xcr3-xm33	golang.org/x/crypto@v0.43.0	0.52.0
Low	ALPINE-CVE-2025-66199	openssl@3.5.4-r0	3.5.5-r0
Low	ALPINE-CVE-2026-40200	musl@1.2.5-r10	1.2.5-r12
Low	GHSA-f83f-xpx7-ffpw	github.com/sigstore/fulcio@v1.7.1	1.8.3
Low	ALPINE-CVE-2026-42767	openssl@3.5.4-r0	3.5.7-r0
Low	ALPINE-CVE-2026-22796	openssl@3.5.4-r0	3.5.5-r0
Low	GHSA-j5w8-q4qc-rx2x	golang.org/x/crypto@v0.43.0	0.45.0
Low	GHSA-qc2q-p7wx-3px3	google.golang.org/grpc@v1.76.0	1.83.1
Low	GHSA-fcv2-xgw5-pqxf	github.com/sigstore/sigstore@v1.9.6-0.20250729224751-181c5d3339b3	1.10.4
Low	GHSA-qpw4-5x99-6vjp	golang.org/x/crypto@v0.43.0	0.52.0
Low	GHSA-9m57-25v3-79x9	golang.org/x/crypto@v0.43.0	0.52.0
Low	GHSA-f6x5-jh6r-wrfv	golang.org/x/crypto@v0.43.0	0.45.0
Low	ALPINE-CVE-2026-34181	openssl@3.5.4-r0	3.5.7-r0
Low	GHSA-vffh-x6r8-xx99	github.com/prometheus/prometheus@v0.51.0	0.311.2-0.20260410083055-07c6232d159b
Low	GHSA-hrxh-6v49-42gf	google.golang.org/grpc@v1.76.0	1.82.1
Low	GO-2026-4981	stdlib@go1.25.0	1.25.10
Low	GO-2026-4986	stdlib@go1.25.0	1.25.10
Low	GHSA-fw8g-cg8f-9j28	github.com/prometheus/prometheus@v0.51.0	0.311.3
Low	GO-2026-4337	stdlib@go1.25.0	1.24.13
Low	GO-2026-4601	stdlib@go1.25.0	1.25.8
Low	GO-2026-4977	stdlib@go1.25.0	1.25.10
Low	GO-2026-4918	golang.org/x/net@v0.46.0	0.53.0
Low	GO-2026-4918	stdlib@go1.25.0	1.25.10
Low	GO-2026-4342	stdlib@go1.25.0	1.24.12
Low	GHSA-59jp-pj84-45mr	github.com/sigstore/fulcio@v1.7.1	1.8.5
Low	GO-2026-4947	stdlib@go1.25.0	1.25.9
Low	GO-2026-6107	go.etcd.io/etcd/client/pkg/v3@v3.6.0	3.5.33

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
2.11.2latest	yesterday	1.8.8	1058335	3,567
2.11.1	26 days ago	1.8.8	1058335	3,567

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/sigstore/fulcio.svg)](https://charts.stackradar.io/charts/sigstore/fulcio)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.