rekor 1.8.7 Helm chart

Name: rekor Helm chart 1.8.7: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

sigstore

Scored 9 Oct 2026

Part of the sigstore project, Rekor is a timestamping server and transparency log for storing signatures, as well as an API based server for validation

Version 1.8.7 yesterdayapp version 1.5.4 4Artifact Hub

rekor 1.8.7 deploys 9 container images: gcr.io/trillian-opensource-ci/db_server, library/busybox, ghcr.io/sigstore/scaffolding/trillian_log_server, ghcr.io/sigstore/scaffolding/trillian_log_signer and 5 more. Across them, 631 findings — 6 critical, 3 high — 2 on CISA KEV. The highest contribution is DSA-5570-1 in nghttp2 1.43.0-1, fixed in 1.43.0-1+deb11u1.

Radar Score

7,58263147475

631 findings over 9 of 9 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

9 images

Image	Tag	Vulnerabilities	Radar Score
gcr.io/trillian-opensource-ci/db_server	digest-pinned	3350120	2,518
library/busybox×2	digest-pinned	0000	0
ghcr.io/sigstore/scaffolding/trillian_log_server	digest-pinned	00021	94
ghcr.io/sigstore/scaffolding/trillian_log_signer	digest-pinned	00021	94
library/redis	digest-pinned	2058107	2,277
curlimages/curl	digest-pinned	102133	784
ghcr.io/sigstore/rekor/rekor-server	v1.5.4	00334	291
ghcr.io/sigstore/scaffolding/createdb	digest-pinned	00669	731
ghcr.io/sigstore/scaffolding/createtree	digest-pinned	00970	793

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Medium findings

78 distinct across the version’s images

Medium: findings whose contribution to the Radar Score is 15–39. Show every band

Severity	Advisory	Package	Fixed in
Medium	ALPINE-CVE-2026-28387	openssl@3.3.3-r0	3.3.7-r0
Medium	GO-2022-1038	stdlib@go1.18.2	1.18.7
Medium	GO-2024-3106	stdlib@go1.18.2	1.22.7
Medium	ALPINE-CVE-2026-55200	libssh2@1.11.1-r0	1.11.1-r2
Medium	GO-2023-1570	stdlib@go1.18.2	1.19.6
Medium	DSA-5587-1	curl@7.74.0-1.3+deb11u10	7.74.0-1.3+deb11u11
Medium	GO-2024-2609	stdlib@go1.18.2	1.21.8
Medium	ALPINE-CVE-2026-34183	openssl@3.5.4-r0	3.5.7-r0
Medium	GO-2024-3107	stdlib@go1.18.2	1.22.7
Medium	ALPINE-CVE-2026-31790	openssl@3.3.3-r0	3.3.7-r0
Medium	ALPINE-CVE-2026-14457	openssl@3.5.4-r0	3.5.8-r0
Medium	GHSA-2v4p-qf9q-27wj	google.golang.org/grpc@v1.77.0	1.82.2
Medium	ALPINE-CVE-2025-9232	openssl@3.3.3-r0	3.3.5-r0
Medium	ALPINE-CVE-2026-9076	openssl@3.3.3-r0	3.3.7-r1
Medium	ALPINE-CVE-2025-69421	openssl@3.3.3-r0	3.3.6-r0
Medium	GO-2023-1751	stdlib@go1.18.2	1.19.9
Medium	GO-2023-1753	stdlib@go1.18.2	1.19.9
Medium	GHSA-vp52-pcj8-j9qc	google.golang.org/grpc@v1.77.0	1.83.1
Medium	GO-2023-1878	stdlib@go1.18.2	1.19.11
Medium	GO-2022-0525	stdlib@go1.18.2	1.17.12
Medium	GO-2022-0520	stdlib@go1.18.2	1.17.12
Medium	ALPINE-CVE-2026-63072	openssl@3.3.3-r0	3.3.7-r1
Medium	ALPINE-CVE-2025-69420	openssl@3.3.3-r0	3.3.6-r0
Medium	ALPINE-CVE-2026-27135	nghttp2@1.65.0-r0	1.68.1
Medium	ALPINE-CVE-2026-7383	openssl@3.5.4-r0	3.5.7-r0
Medium	GO-2026-4601	stdlib@go1.25.0	1.25.8
Medium	GO-2026-4981	stdlib@go1.25.0	1.25.10
Medium	ALPINE-CVE-2026-28390	openssl@3.3.3-r0	3.3.7-r0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
1.8.7latest	yesterday	1.5.4	63147475	7,582
1.8.6	24 days ago	1.5.4	63161487	8,420
1.8.5	1 month ago	1.5.4	64161488	8,489

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/sigstore/rekor.svg)](https://charts.stackradar.io/charts/sigstore/rekor)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.