scaffold 0.6.116 Helm chart

Name: scaffold Helm chart 0.6.116: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

sigstore

Scored 6 Oct 2026

Scaffolding the components of the sigstore architecture

Version 0.6.116 todayApp version not verified against the render 1Artifact Hub

scaffold 0.6.116 deploys 15 container images: ghcr.io/sigstore/scaffolding/ct_server, ghcr.io/sigstore/fulcio, library/redis, curlimages/curl and 9 more. Across them, 869 findings — 6 critical, 3 high — 2 on CISA KEV. The highest contribution is DSA-5570-1 in nghttp2 1.43.0-1, fixed in 1.43.0-1+deb11u1.

Radar Score

11,29263212648

869 findings over 15 of 15 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

15 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/sigstore/scaffolding/ct_server	v0.7.31	002171	1,107
ghcr.io/sigstore/fulcio	v1.9.0	0011	20
library/redis	digest-pinned	205896	2,241
curlimages/curl	digest-pinned	102132	772
ghcr.io/sigstore/rekor/rekor-server	v1.5.4	00316	219
gcr.io/trillian-opensource-ci/db_server	digest-pinned	3350107	2,465
library/busybox×2	digest-pinned	0000	0
ghcr.io/sigstore/scaffolding/trillian_log_server	digest-pinned	00745	585
ghcr.io/sigstore/scaffolding/trillian_log_signer	digest-pinned	00745	585
curlimages/curl	8.17.0	102132	772
ghcr.io/sigstore/scaffolding/createctconfig	v0.7.31	001669	1,017
ghcr.io/sigstore/scaffolding/createtree	v0.7.31	00952	721
ghcr.io/sigstore/scaffolding/createcerts	digest-pinned	001363	901
ghcr.io/sigstore/scaffolding/createtree	digest-pinned	00952	721
ghcr.io/sigstore/scaffolding/createdb	digest-pinned	00651	659

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Medium findings

90 distinct across the version’s images

Medium: findings whose contribution to the Radar Score is 15–39. Show every band

Severity	Advisory	Package	Fixed in
Medium	GO-2023-2375	stdlib@go1.18.2	1.20.0
Medium	GO-2023-1569	stdlib@go1.18.2	1.19.6
Medium	GO-2022-1143	stdlib@go1.18.2	1.18.9
Medium	GHSA-x527-x647-q7gg	golang.org/x/crypto@v0.43.0	0.52.0
Medium	ALPINE-CVE-2026-28387	openssl@3.3.3-r0	3.3.7-r0
Medium	GO-2022-1038	stdlib@go1.18.2	1.18.7
Medium	GHSA-5cgq-3rg8-m6cv	golang.org/x/crypto@v0.43.0	0.52.0
Medium	GHSA-rm3j-f69w-wqmq	golang.org/x/crypto@v0.43.0	0.52.0
Medium	GO-2024-3106	stdlib@go1.18.2	1.22.7
Medium	ALPINE-CVE-2026-55200	libssh2@1.11.1-r0	1.11.1-r2
Medium	GO-2023-1570	stdlib@go1.18.2	1.19.6
Medium	GHSA-vgwf-h737-ff37	golang.org/x/crypto@v0.43.0	0.52.0
Medium	DSA-5587-1	curl@7.74.0-1.3+deb11u10	7.74.0-1.3+deb11u11
Medium	GO-2026-6107	go.etcd.io/etcd/client/pkg/v3@v3.6.0	3.5.33
Medium	GO-2024-2609	stdlib@go1.18.2	1.21.8
Medium	ALPINE-CVE-2026-34183	openssl@3.5.4-r0	3.5.7-r0
Medium	GO-2024-3107	stdlib@go1.18.2	1.22.7
Medium	ALPINE-CVE-2026-31790	openssl@3.3.3-r0	3.3.7-r0
Medium	ALPINE-CVE-2026-14457	openssl@3.5.4-r0	3.5.8-r0
Medium	GO-2026-6443	google.golang.org/grpc@v1.84.0	1.82.2
Medium	ALPINE-CVE-2025-9232	openssl@3.3.3-r0	3.3.5-r0
Medium	ALPINE-CVE-2026-9076	openssl@3.3.3-r0	3.3.7-r1
Medium	ALPINE-CVE-2025-69421	openssl@3.3.3-r0	3.3.6-r0
Medium	GO-2023-1751	stdlib@go1.18.2	1.19.9
Medium	GO-2023-1753	stdlib@go1.18.2	1.19.9
Medium	GHSA-vp52-pcj8-j9qc	google.golang.org/grpc@v1.76.0	1.83.1
Medium	GO-2023-1878	stdlib@go1.18.2	1.19.11
Medium	GO-2022-0525	stdlib@go1.18.2	1.17.12
Medium	GO-2022-0520	stdlib@go1.18.2	1.17.12
Medium	ALPINE-CVE-2026-63072	openssl@3.3.3-r0	3.3.7-r1
Medium	ALPINE-CVE-2025-69420	openssl@3.3.3-r0	3.3.6-r0
Medium	GHSA-8rm2-7qqf-34qm	github.com/prometheus/prometheus@v0.51.0	0.305.2
Medium	ALPINE-CVE-2026-27135	nghttp2@1.65.0-r0	1.68.1
Medium	ALPINE-CVE-2026-7383	openssl@3.5.4-r0	3.5.7-r0
Medium	GHSA-mh2q-q3fh-2475	go.opentelemetry.io/otel@v1.38.0	1.41.0
Medium	GHSA-89gr-r52h-f8rx	golang.org/x/crypto@v0.43.0	0.52.0
Medium	GHSA-jppx-rxg9-jmrx	golang.org/x/crypto@v0.43.0	0.52.0
Medium	GO-2026-4601	stdlib@go1.25.0	1.25.8
Medium	GO-2026-4981	stdlib@go1.25.0	1.25.10
Medium	ALPINE-CVE-2026-28390	openssl@3.3.3-r0	3.3.7-r0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.6.116latest	today	—	63212648	11,292
0.6.115	20 days ago	—	63214666	11,510
0.6.114	1 month ago	—	64214667	11,579

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/sigstore/scaffold.svg)](https://charts.stackradar.io/charts/sigstore/scaffold)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.