Executive brief
Cube Core is an open-source analytics backend that processes data queries for business intelligence applications. An authenticated attacker can crash the entire API service by sending a specially crafted request, rendering the analytics platform unavailable to all users and disrupting reporting and dashboard functionality.
Technical details
This vulnerability is a Denial of Service (DoS) issue in Cube Core's request handling (CWE-755: Improper Handling of Exceptional Conditions). An authenticated attacker with valid credentials can submit a maliciously crafted request to a Cube API endpoint that triggers an unhandled exception, crashing the server process and making the entire API unavailable. The vulnerability requires network access and valid authentication, but no user interaction. Affected versions are 1.1.17 and later; patches are available in versions 1.4.2 (LTS) and 1.5.13 (regular release).
Affected products
- Cube Cube Core >=1.1.17, <1.4.2, >=1.5.0 <1.5.13
Timeline
- 2026-02-09: disclosed
- 2026-02-10: patched: Patches released in versions 1.4.2 and 1.5.13