Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-09 | 1 | General1 |
| 2026-02-10 | 2 | Disclosure2 |
CVE-2026-25958 Privilege Escalation Vulnerability in Cube Semantic Layer Across Multiple Versions https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25958
Post summary
The entry announces a privilege escalation vulnerability in Cube Semantic Layer across multiple versions, but does not provide any PoC, exploit, patch, or active exploitation information.
CVE-2026-25958 Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a v… https://www.cve.org/CVERecord?id=CVE-2026-25958
Post summary
The text briefly mentions CVE-2026-25958 as affecting Cube versions 0.27.19 through 1.5.13, noting that a specially crafted request may trigger the issue, but no further technical or exploit information is provided.
CVE-2026-25958: The Cube Root of Chaos: Smuggling Admin Privileges via WebSocket Pollution Cube (formerly Cube.js) is the self-proclaimed 'semantic layer' for building data applications—a fancy way of saying it sits between your messy SQL databases an... https://cvereports.com/reports/CVE-2026-25958
Post summary
The text announces CVE-2026-25958, describing a privilege escalation attack via WebSocket pollution, but does not provide a PoC, exploit code, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | cube | cube.js | - | node.js | - |