CVE-2026-25958: Privilege Escalation Vulnerability in @cubejs-backend/server-core
Summary
CVE-2026-25958: Cube Core is vulnerable to privilege escalation via a specially crafted request. Affects @cubejs-backend/server-core across 3 version ranges.
>= 0.27.19, < 1.0.14
>= 1.1.0, < 1.4.2
>= 1.5.0, < 1.5.13
Fixed in 1.0.14, 1.4.2 or 1.5.13, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @cubejs-backend/server-core package is a core component of the Cube.js framework, which is designed for building data applications. It provides a powerful API for querying and managing data, enabling developers to create analytics applications efficiently. However, a recent vulnerability has been identified that allows for privilege escalation through specially crafted requests, posing a significant security risk to applications using this package.
Vulnerability Detail
The vulnerability arises from the ability to send a specially crafted request with a valid API token, which can lead to unauthorized privilege escalation. This means that an attacker could potentially gain higher access rights than intended, compromising the security of the application. The issue was reported by a core engineer and has been classified under CWE-807, indicating a failure to restrict or control access to a resource. The technical implications of this vulnerability could allow malicious users to perform actions that should be restricted, leading to data breaches or unauthorized data manipulation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.27.19, < 1.0.141.0.14npm install @cubejs-backend/server-core@1.0.14 -
>= 1.1.0, < 1.4.21.4.2npm install @cubejs-backend/server-core@1.4.2 -
>= 1.5.0, < 1.5.131.5.13npm install @cubejs-backend/server-core@1.5.13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched versions as soon as possible to mitigate the risk.
Conclusion
The CVE-2026-25958 vulnerability in the @cubejs-backend/server-core package poses a significant risk of privilege escalation through specially crafted requests. It is crucial for developers using this package to upgrade to the patched versions to mitigate potential security threats. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for @cubejs-backend/server-core →
FAQ
CVE-2026-25958 is a vulnerability in the @cubejs-backend/server-core package that allows for privilege escalation through specially crafted requests.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
While there are no specific workarounds, it is crucial to plan for an upgrade to the patched versions as soon as possible to ensure the security of your application.
The patched versions are 1.5.13 and later for regular releases, 1.4.2 for active LTS releases, and 1.0.14 for end-of-life LTS releases.
The CVSS score for this vulnerability is 7.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @cubejs-backend/server-core.
