Cube Core is vulnerable to privilege escalation via a specially crafted request

CAO 7.7CVE-2026-25958 · GHSA-v226-32c7-x2v7 · Công bố 09/02/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-25958 là lỗ hổng mức CAO (CVSS 7.7) ảnh hưởng cube.js (cube), @cubejs-backend/server-core.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.38%, cao hơn 32.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.0.14, 1.4.2, 1.5.13 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
cube.js cube	`≥ 0.27.19, < 1.0.14≥ 1.1.0, < 1.4.2≥ 1.5.0, < 1.5.13`	`1.0.141.4.21.5.13`
@cubejs-backend/server-core npm	`≥ 0.27.19, < 1.0.14≥ 1.1.0, < 1.4.2≥ 1.5.0, < 1.5.13`	`1.0.141.4.21.5.13`

Mô tả

Impact

It is possible to make a specially crafted request with a valid API token that leads to privilege escalation.

Affected Versions:

≥= 0.27.19

Mitigation:

Upgrade to a patched version:

1.5.13 and later (regular release)
1.4.2 (active LTS release)
1.0.14 (end-of-life LTS release)

References

The issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.

Mô tả của NVD

Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14.