CVE-2026-25958 Cube privilege escalation via a specially crafted request
Attackers with valid API tokens can escalate privileges in Cube via specially crafted requests, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25958?
CVE-2026-25958 is a high-severity vulnerability in cube-js cube, published on 9 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14.
Weakness: CWE-807
Which versions are affected by CVE-2026-25958?
6 open source packages ship an affected version, including @cubejs-backend/server-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@cubejs-backend/server-core npm | From 0.27.19 | 1.0.14 |
@cubejs-backend/server-core npm | From 0.27.19 | 1.0.14 |
@cubejs-backend/server-core npm | From 1.1.0 | 1.4.2 |
@cubejs-backend/server-core npm | From 1.1.0 | 1.4.2 |
@cubejs-backend/server-core npm | From 1.5.0 | 1.5.13 |
@cubejs-backend/server-core npm | From 1.5.0 | 1.5.13 |
Products include Cube Cube.js.
How do I fix CVE-2026-25958?
Upgrade @cubejs-backend/server-core to a fixed version for your release line: 1.0.14, 1.4.2 or 1.5.13.
Is CVE-2026-25958 being exploited?
There is no known exploitation of CVE-2026-25958 in the wild and no public exploit code.
Other vulnerabilities in cube-js cube
Sources
Also known as GHSA-v226-32c7-x2v7.