Skip to content
QuenchWorks

VEXgraylog

graylog

1 statement, issued .Each one is a scanner finding that is not exploitable in this image, and why.

ImageOpenVEX JSON

@id https://quench-works.com/vex/graylog/2026-11-05

  1. CVE-2026-56130

    not affected · vulnerable code not in execute path
    • shiro-core 2.2.1

    Measured 2026-11-05 on a local build of graylog 7.1.12 (quench-graylog-7.1.12-r0.apk, /opt/graylog/graylog.jar). CVE-2026-56130 is the Shiro remember-me cookie not being checked for expiry on the server; the cookie handling is shiro-web's CookieRememberMeManager, installed by shiro-web's DefaultWebSecurityManager. graylog.jar ships 441 org/apache/shiro classes and no org/apache/shiro/web path at all (unzip -l), so neither class is in the image. shiro-core's DefaultSecurityManager only calls a RememberMeManager when one is set, and its default is null; a byte scan of every class in graylog.jar outside org/apache/shiro found 0 that reference RememberMe, so Graylog never sets one. The remember-me path cannot run. The fix is only in Shiro 3.0.0, a major line Graylog 7.1 does not use; revisit when Graylog moves to Shiro 3 or adds shiro-web.