VEXdatahub-frontend
datahub-frontend
1 statement, issued .Each one is a scanner finding that is not exploitable in this image, and why.
@id https://quench-works.com/vex/datahub-frontend/2026-11-09
CVE-2026-56130
not affected · vulnerable code not present- shiro-core 2.2.1
Measured 2026-11-09 on the published datahub-frontend 1.8.0 and 1.7.0.1 images (crane export). CVE-2026-56130 is the Shiro remember-me cookie not being checked for expiry on the server; that cookie handling is shiro-web's CookieRememberMeManager. Both images ship the same eleven Shiro 2.2.1 jars in datahub-frontend/lib (cache, config-core, config-ogdl, core, crypto-cipher, crypto-core, crypto-hash, event, hashes-argon2, hashes-bcrypt, lang) and no shiro-web jar, so CookieRememberMeManager is not in the image. A byte scan of every non-Shiro jar in 1.8.0 found only two classes that reference org/apache/shiro: DataHub's auth/pac4j/Shiro2AesDataEncrypter (AesCipherService, ByteSource: pac4j session encryption) and pac4j-core's ShiroPasswordEncoder (hashing). Neither touches a SecurityManager or remember-me; DataHub authenticates through pac4j and Play sessions, not Shiro subjects. The fix exists only in Shiro 3.0.0, a major line DataHub does not use.