Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request

Vulnerability

Cube, an open-source semantic layer for building data applications, is susceptible to a denial-of-service vulnerability. In versions 1.1.17 through 1.5.12 and 1.4.1, a specially crafted request to a Cube API endpoint can cause the entire API to become unavailable [1][3]. This essentially results in a server crash, preventing legitimate use of the data service.

Exploitation

To exploit the vulnerability, an attacker must be authenticated, as indicated by the advisory referencing 'authenticated attacker' [3]. The attack requires only a single specially crafted request to an API endpoint—no complex chaining of requests is necessary. This low complexity and lack of required privileges beyond authentication make it a relatively straightforward attack to execute.

Impact

Successful exploitation leads to a complete denial of service. The Cube API becomes unresponsive, affecting all downstream applications, AI agents, BI tools, and embedded analytics that rely on the semantic layer. The impact is limited to availability; there is no evidence of data breach or privilege escalation from the provided sources [1][3].

Mitigation

Cube has released patches in versions 1.5.13 (regular release) and 1.4.2 (active LTS release) [3]. Users running any version between 1.1.17 and these patched versions should upgrade immediately. No workarounds are mentioned in the advisories; updating to the latest fixed version is the recommended course of action [3].