Security

SECURITY.md

Security Policy

Reporting a Vulnerability

Please email security reports to info@cube.dev or reach out to maintainers directly in https://slack.cube.dev. Please do not create issues or public conversations for discovered security issues until patch is shipped.

Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request
GHSA-9vph-2hvm-x66g published Feb 9, 2026 by bsod90

Moderate
Privilege escalation via a specially crafted request
GHSA-v226-32c7-x2v7 published Feb 9, 2026 by bsod90

High
Denial of service attack on the cube-api endpoint
GHSA-9759-3276-g2pm published Dec 13, 2023 by bsod90

Moderate
Row level security bypass
GHSA-6jqm-3c9g-pch7 published Dec 9, 2022 by bsod90

High
Default Express middleware security check is ignored in production
GHSA-4j6x-w426-6rc6 published Nov 8, 2019 by paveltiunov

High

Learn more about advisories related to cube-js/cube in the GitHub Advisory Database

Overview · cube-js/cube · GitHub

Uh oh!

Security

SECURITY.md

Security Policy

Reporting a Vulnerability

Overview · cube-js/cube · GitHub

Uh oh!

Security: cube-js/cube

Security

SECURITY.md

Security Policy

Reporting a Vulnerability