Vulnerabilities in Shuffle Security

You can inspect, query, and modify records in the Datastore console:

• Shuffle Security Datastore: Navigate to /admin/datastore?category=shuffle-security_vulns. Automatically queries the local datastore if configured, and falls back to Shuffle Core if local storage is not initialized.
• Shuffle Core Datastore: Open in Shuffle Core Datastore (https://shuffler.io/admin?tab=datastore&category=shuffle-security_vulns or /admin?tab=datastore&category=shuffle-security_vulns on self-hosted Core).
• Manual UI Navigation: Go to Admin -> Datastore -> select category shuffle-security_vulns.

Deleting Erroneously Ingested Vulnerabilities (Admin Only)

We've all had a scanner misbehave, an API misfire, or a test script accidentally dump dummy CVEs into production. When that happens, you might notice that the main queue at /vulnerabilities doesn't have a big red "Delete" button. That's intentional—in day-to-day triage you usually want to resolve, mitigate, or accept findings rather than deleting historical records.

If you ingested bad data and need to wipe it out completely, an admin can do that directly in the Datastore:

1. Head over to Admin in the top navigation bar.
2. Click the Datastore tab, or jump straight to /admin/datastore?category=shuffle-security_vulns (if you're on self-hosted Shuffle Core, that's /admin?tab=datastore&category=shuffle-security_vulns).
3. Search for the vulnerability key you want to remove (like CVE-2024-3094).
4. Delete one finding: Click the trash button on the right side of the row and confirm.
5. Bulk cleanup: Check the boxes next to the ones you want gone, and click Delete up in the table header.

A quick heads-up: inside the Shuffle Security UI, /admin/datastore is restricted to admins (isAdmin). If you don't have admin permissions, you'll see a notice asking you to reach out to an admin on your team to clear it out.

Vulnerability Record Schema

Writing Findings in Python Apps & Workflows

# Upsert or update a vulnerability finding
vuln_payload = {
    "id": "CVE-2024-3094",
    "title": "XZ Utils Backdoor (liblzma)",
    "severity": "critical",
    "score": 10.0,
    "category": "software_cve",
    "status": "open",
    "affected_package": "xz-utils 5.6.0",
    "fixed_version": "5.6.1",
    "affected_hosts": [
        {
            "hostname": "srv-prod-db-01",
            "path": "/usr/lib/x86_64-linux-gnu/liblzma.so.5.6.0",
            "resolution": "open"
        }
    ]
}

# Write to Datastore
self.set_cache(
    key="CVE-2024-3094",
    value=vuln_payload,
    category="shuffle-security_vulns"
)

Key revisions, audit trail & rollback protection

All vulnerability records stored in shuffle-security_vulns are automatically versioned with immutable revisions. Every scanner sweep, automated triage run, or manual status change preserves historical snapshots:

• Protection Against Ingestion Drift & Overwrites: If an external vulnerability scanner runs an incomplete scan that accidentally drops existing CVE findings or marks active flaws as cleared, previous revisions remain accessible. Analysts can inspect historical snapshots and restore missing findings immediately.
• Audit Attribution: Tracks which workflow execution or analyst changed the finding's severity, updated the CVSS score, marked a host as mitigated, or accepted risk, complete with timestamps and execution IDs.
• Rollback via API & Workflows:
  • Fetch all revisions for a vulnerability advisory:

    API Call

    GET

    cURL

    Python

    HTTP

    CopyTest

    curl -X GET 'https://uk.shuffle.security/api/v2/datastore/category/shuffle-security_vulns/{cve_id}/revisions' \
      -H 'Authorization: Bearer <api_key…'

    Response

    Close

    No response received.

  • Roll back or restore in Python:
    python

    # Retrieve revision history
    revisions = self.get_cache_revisions(key="CVE-2024-3094", category="shuffle-security_vulns")
    
    # Revert to earlier verified snapshot if scan corrupted data
    if len(revisions) > 1:
        self.set_cache(
            key="CVE-2024-3094",
            value=revisions[1]["value"],
            category="shuffle-security_vulns"
        )
    

Ingestion: webhooks, scanners & OSV

Shuffle supports multiple paths to ingest and look up vulnerabilities:

1. Inbound Webhook

You can push findings from CI/CD pipelines, container scanners, or external security tools directly into Shuffle:

• Go to /vulnerabilities in the web app.
• Click the "Webhook" button in the header bar to open the configuration modal.
• The modal displays your dynamic inbound endpoint:
  code

  https://<instance>/api/v1/hooks/webhook_<hook_id>
  

• Payloads sent to this webhook trigger the vulnerabilities_webhook workflow, which normalizes findings and writes them to the datastore.

2. Live OSV.dev Lookup

You can query the open-source vulnerability database directly from the Shuffle UI:

• Enter a CVE ID (e.g. CVE-2024-3094), a GitHub Advisory ID (e.g. GHSA-xxxx-xxxx-xxxx), or an affected package name into the search bar at /vulnerabilities.
• The system queries https://api.osv.dev/v1/vulns/<id> to display advisory details, severity, affected versions, and published fixes.

3. Host Monitor Code Scanner

When endpoints run Shuffle Host Monitors with the Code Package Scanner enabled, the local agent scans project directories for manifest files (package.json, requirements.txt, Cargo.toml, go.mod). Discovered dependencies are evaluated against OSV.dev and registered in shuffle-security_vulns with the host's identity and file path.

4. Polling Workflows

For external scanners with REST APIs, scheduled Shuffle workflows (such as Ingest Vulnerabilities) regularly pull findings, deduplicate entries, and write them to the datastore.

Host & package correlation

A vulnerability finding is actionable when you know which systems are affected.

When Host Monitors discover a vulnerable package on an endpoint, Shuffle stores the finding with host-level granularity:

• Hostname & Asset ID: Identifies the exact machine running the vulnerable code or package.
• Filesystem Paths: Lists the specific directory where the dependency was found (e.g. /home/user/projects/web-api/package.json).
• Installed Version: Records the current version versus the fixed version from the advisory.

Per-Host Resolution Status

Because a vulnerability may exist across multiple servers or laptops, you can track resolution status individually for each host in the vulnerability detail view:

The Vulnerabilities dashboard

The dashboard at /vulnerabilities provides an operational overview of all recorded findings:

Navigation & Filtering

• Category Tabs: Switch between All, Software / CVE, User / Identity, Cloud Misconfig, and Code / Deps.
• Severity Filter: Filter by Critical, High, Medium, Low, or Info.
• Status Filter: View Open, In Progress, Resolved, or Accepted findings.
• Search Bar: Query by identifier, package name, or keywords.

Table Columns

• Severity: Normalized severity indicator (Critical, High, Medium, Low, Info).
• Identifier / Title: CVE or GHSA identifier with a summary of the advisory.
• Category: Finding category pill (code_dependency, software_cve, etc.).
• Source: Ingestion origin (e.g. osv:npm, osv:pypi, or scanner name).
• Status: Lifecycle status (Open, In Progress, Resolved, Accepted).
• First Seen: Timestamp when the finding was first ingested or discovered.

Detail View

Clicking any finding navigates to /vulnerabilities/:id, displaying:

• Complete advisory text, published and modified dates, and references.
• Affected package ecosystems, package names, and version ranges.
• List of affected hosts with install paths and per-host resolution controls.
• AI investigation panel for questions about the advisory.

Automation readiness

Shuffle Security checks whether your core vulnerability automation workflows are configured:

┌────────────────────────────────────────────────────────────────────────┐
│                   Vulnerability Automation Readiness                   │
├────────────────────────┬───────────────────────────────────────────────┤
│ Vulnerability Webhook  │ [Active]         api/v1/hooks/webhook_<id>    │
│ Vulnerability Ingest   │ [Active]         Ingest Vulnerabilities       │
│ Vuln Correlation       │ [Active]         Vulnerability Correlation    │
│ Vulnerability Response │ [In Development] Coming soon                  │
└────────────────────────┴───────────────────────────────────────────────┘

[!TIP] Enabling Automations
Click "Enable all" on the readiness card to generate and activate the foundational ingestion and correlation workflows, or manage them individually from the /usecases page.

API & Datastore reference

All vulnerability findings are stored directly in Shuffle's Datastore under the shuffle-security_vulns category. You can query, ingest, and update findings via the REST API, inspect them in the Datastore web console, or access them inside custom Shuffle Python apps.

Inspect and manage vulnerability records in the Datastore console:

• Shuffle Security Datastore: Navigate to /admin/datastore?category=shuffle-security_vulns. Uses the local datastore if available, and automatically redirects to Shuffle Core if local datastore is not configured.
• Shuffle Core Datastore: Open in Shuffle Core Datastore (https://shuffler.io/admin?tab=datastore&category=shuffle-security_vulns).
• Manual UI Navigation: Go to Admin -> Datastore -> select category shuffle-security_vulns.

REST API Endpoints

• List Vulnerabilities: GET /api/v1/vulnerabilities
• Get Vulnerability Finding: GET /api/v1/vulnerabilities/{id}
• List Findings from Datastore Directly:

  API Call

  GET

  cURL

  Python

  HTTP

  CopyTest

  curl -X GET 'https://<instance>/api/v1/orgs/<org_id>/list_cache?category=shuffle-security_vulns&top=100' \
    -H 'Authorization: Bearer $SHUFFLE…'

  Response

  Close

  No response received.

• Upsert Finding in Datastore:

  API Call

  POST

  cURL

  Python

  HTTP

  JSON

  CopyTest

  curl -X POST 'https://<instance>/api/v1/orgs/<org_id>/set_cache' \
    -H 'Authorization: Bearer $SHUFFLE…' \
    -H 'Content-Type: application/json' \
    -d '{
    "category": "shuffle-security_vulns",
    "key": "CVE-2024-3094",
    "value": "{\"id\":\"CVE-2024-3094\",\"title\":\"XZ Utils Backdoor\",\"severity\":\"critical\",\"category\":\"software_cve\",\"status\":\"open\"}"
  }'

  Response

  Close

  No response received.

In Custom Python Apps & Workflows

# Retrieve a vulnerability record from the datastore
vuln = self.get_cache("CVE-2024-3094", category="shuffle-security_vulns")

# Check status or update notes
if vuln and vuln.get("status") == "open":
    print(f"Open vulnerability: {vuln.get('title')}")
    vuln["status"] = "in_progress"
    self.set_cache("CVE-2024-3094", vuln, category="shuffle-security_vulns")

For more details on backend API endpoints and datastore caching rules, see the API documentation.